From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from hall.aurel32.net (hall.aurel32.net [IPv6:2001:bc8:30d7:100::1]) by sourceware.org (Postfix) with ESMTPS id 9E88F3858430 for ; Sat, 9 Jul 2022 08:46:25 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 9E88F3858430 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=aurel32.net Authentication-Results: sourceware.org; spf=none smtp.mailfrom=aurel32.net DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=aurel32.net ; s=202004.hall; h=Content-Transfer-Encoding:MIME-Version:Message-Id:Date: Subject:Cc:To:From:Content-Type:From:Reply-To:Subject:Content-ID: Content-Description:In-Reply-To:References:X-Debbugs-Cc; bh=o1St8d4RjzmbDP+QYE6G7337PFG+oPATdqs7sSm2p9c=; b=cbKmcxtoij5VTGkj3EuvhmQEIn 5nIjDaj/lP8A20g2dsxD2i5rEbLBZBcq7DjWj6vCAja7cqR6TtPTycueUavY5l/kbV8DgKXm1esi3 OKS6NmpRHh+M1cfn0r6qsinW0L3RSeTIeYHfVI7ssaklrTUwEMjIPeTfzecurT4ji7Vq6+DIWIcJc +C+h9yOdxA++Yh8I/gW/HzCQyjnEpY6whIu7fxmLr5nG3NOqXNeYG81VQxNwQxnmXpZV4PTsEUPvi XPu217K+gvIdfhOQCkzzCqElRMoEE49k10Tft35xRSAxf51+2E4rzZdEESTPVcXNSDXnCKub4W0px GIE0olBg==; Received: from [2a01:e34:ec5d:a741:8a4c:7c4e:dc4c:1787] (helo=ohm.rr44.fr) by hall.aurel32.net with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1oA66Z-006gvx-7w; Sat, 09 Jul 2022 10:46:23 +0200 Received: from aurel32 by ohm.rr44.fr with local (Exim 4.95) (envelope-from ) id 1oA66Y-0019Vv-Pv; Sat, 09 Jul 2022 10:46:22 +0200 From: Aurelien Jarno To: libc-stable@sourceware.org Cc: Florian Weimer , "H . J . Lu" Subject: [COMMITTED 2.33] elf: Earlier missing dynamic segment check in _dl_map_object_from_fd Date: Sat, 9 Jul 2022 10:46:21 +0200 Message-Id: <20220709084621.274876-1-aurelien@aurel32.net> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-13.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, SPF_HELO_PASS, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-stable@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-stable mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Jul 2022 08:46:27 -0000 From: Florian Weimer Separated debuginfo files have PT_DYNAMIC with p_filesz == 0. We need to check for that before the _dl_map_segments call because that could attempt to write to mappings that extend beyond the end of the file, resulting in SIGBUS. Reviewed-by: H.J. Lu (cherry picked from commit ea32ec354c65ddad11b82ca9d057010df13a9cea) --- elf/dl-load.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/elf/dl-load.c b/elf/dl-load.c index 2f760503c5..639d78083c 100644 --- a/elf/dl-load.c +++ b/elf/dl-load.c @@ -1114,6 +1114,7 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, struct loadcmd loadcmds[l->l_phnum]; size_t nloadcmds = 0; bool has_holes = false; + bool empty_dynamic = false; /* The struct is initialized to zero so this is not necessary: l->l_ld = 0; @@ -1126,7 +1127,9 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, segments are mapped in. We record the addresses it says verbatim, and later correct for the run-time load address. */ case PT_DYNAMIC: - if (ph->p_filesz) + if (ph->p_filesz == 0) + empty_dynamic = true; /* Usually separate debuginfo. */ + else { /* Debuginfo only files from "objcopy --only-keep-debug" contain a PT_DYNAMIC segment with p_filesz == 0. Skip @@ -1248,6 +1251,13 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, goto lose; } + /* This check recognizes most separate debuginfo files. */ + if (__glibc_unlikely ((l->l_ld == 0 && type == ET_DYN) || empty_dynamic)) + { + errstring = N_("object file has no dynamic section"); + goto lose; + } + /* Length of the sections to be loaded. */ maplength = loadcmds[nloadcmds - 1].allocend - loadcmds[0].mapstart; @@ -1265,15 +1275,7 @@ _dl_map_object_from_fd (const char *name, const char *origname, int fd, } } - if (l->l_ld == 0) - { - if (__glibc_unlikely (type == ET_DYN)) - { - errstring = N_("object file has no dynamic section"); - goto lose; - } - } - else + if (l->l_ld != 0) l->l_ld = (ElfW(Dyn) *) ((ElfW(Addr)) l->l_ld + l->l_addr); elf_get_dynamic_info (l, NULL); -- 2.35.1