Re: segfault in ffi_data_to_code_pointer

[Florian Weimer <fweimer@redhat.com>]

* DJ Delorie:

> In src/closures.c, ffi_data_to_code_pointer() calls segment_holding()
> to get a pointer to the code segment for a data segment.  It doesn't
> check for a NULL return, and I've got a test case where I run Ruby's
> test suite (on a non-selinux aarch64 machine, if that matters) and
> segment_holding() returns NULL and much hilarity ensues.
>
> The following patch fixes the segfault, but I don't know if
> segment_holding() returning NULL is an expected case, or a symptom of
> problems elsewhere?
>
>> diff -rup a/src/closures.c b/src/closures.c
>> --- a/src/closures.c	2019-06-25 21:21:06.738743440 -0400
>> +++ b/src/closures.c	2019-06-25 21:22:00.769716129 -0400
>> @@ -621,7 +621,10 @@ void *
>>  ffi_data_to_code_pointer (void *data)
>>  {
>>    msegmentptr seg = segment_holding (gm, data);
>> -  return add_segment_exec_offset (data, seg);
>> +  if (seg)
>> +    return add_segment_exec_offset (data, seg);
>> +  else
>> +    return data;
>>  }

I think you also need to fix the aarch64 code to avoid a null pointer
dereference, like below.  Also submitted as
<https://github.com/libffi/libffi/pull/499>.

I have verified that this fixes the Ruby build failure.

Thanks,
Florian

diff --git a/src/aarch64/ffi.c b/src/aarch64/ffi.c
index 6f6aac4..69e04d6 100644
--- a/src/aarch64/ffi.c
+++ b/src/aarch64/ffi.c
@@ -777,7 +777,8 @@ ffi_prep_closure_loc (ffi_closure *closure,
 
   /* Also flush the cache for code mapping.  */
   unsigned char *tramp_code = ffi_data_to_code_pointer (tramp);
-  ffi_clear_cache (tramp_code, tramp_code + FFI_TRAMPOLINE_SIZE);
+  if (tramp_code != NULL)
+    ffi_clear_cache (tramp_code, tramp_code + FFI_TRAMPOLINE_SIZE);
 #endif
 
   closure->cif = cif;
diff --git a/src/closures.c b/src/closures.c
index 4d7f945..18d3913 100644
--- a/src/closures.c
+++ b/src/closures.c
@@ -925,6 +925,8 @@ void *
 ffi_data_to_code_pointer (void *data)
 {
   msegmentptr seg = segment_holding (gm, data);
+  if (seg == NULL)
+    return NULL;
   return add_segment_exec_offset (data, seg);
 }