lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-28 00:21:52 +03:00
Code Activity

Fix BZ 20419. A PT_NOTE in a binary could be arbitratily large, so using

Browse Source 
alloca for it may cause stack overflow.  If the note is larger than
__MAX_ALLOCA_CUTOFF, use dynamically allocated memory to read it in.

2018-05-05  Paul Pluzhnikov  <ppluzhnikov@google.com>

	[BZ #20419]
	* elf/dl-load.c (open_verify): Fix stack overflow.
	* elf/Makefile (tst-big-note): New test.
	* elf/tst-big-note-lib.S: New.
	* elf/tst-big-note.c: New.
This commit is contained in:
Paul Pluzhnikov
2018-05-05 18:08:27 -07:00
parent b289cd9db8
commit 0065aaaaae
5 changed files with 85 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
elf/dl-load.c
View File

@ -1462,6 +1462,7 @@ open_verify (const char *name, int fd,
ElfW(Ehdr) *ehdr;
ElfW(Phdr) *phdr, *ph;
ElfW(Word) *abi_note;
ElfW(Word) *abi_note_malloced = NULL;
unsigned int osversion;
size_t maplength;
@ -1633,10 +1634,25 @@ open_verify (const char *name, int fd,
abi_note = (void *) (fbp->buf + ph->p_offset);
else
{
abi_note = alloca (size);
/* Note: __libc_use_alloca is not usable here, because
thread info may not have been set up yet. */
if (size < __MAX_ALLOCA_CUTOFF)
abi_note = alloca (size);
else
{
/* There could be multiple PT_NOTEs. */
abi_note_malloced = realloc (abi_note_malloced, size);
if (abi_note_malloced == NULL)
goto read_error;
abi_note = abi_note_malloced;
}
__lseek (fd, ph->p_offset, SEEK_SET);
if (__libc_read (fd, (void *) abi_note, size) != size)
goto read_error;
{
free (abi_note_malloced);
goto read_error;
}
}
while (memcmp (abi_note, &expected_note, sizeof (expected_note)))
@ -1671,6 +1687,7 @@ open_verify (const char *name, int fd,
break;
}
free (abi_note_malloced);
}
return fd;