mirror of
https://sourceware.org/git/glibc.git
synced 2025-08-07 06:43:00 +03:00
debug: Improve '%n' fortify detection (BZ 30932)
The 7bb8045ec0
path made the '%n' fortify check ignore EMFILE errors
while trying to open /proc/self/maps, and this added a security
issue where EMFILE can be attacker-controlled thus making it
ineffective for some cases.
The EMFILE failure is reinstated but with a different error
message. Also, to improve the false positive of the hardening for
the cases where no new files can be opened, the
_dl_readonly_area now uses _dl_find_object to check if the
memory area is within a writable ELF segment. The procfs method is
still used as fallback.
Checked on x86_64-linux-gnu and i686-linux-gnu.
Reviewed-by: Arjun Shankar <arjun@redhat.com>
This commit is contained in:
@@ -576,7 +576,8 @@ static const uint8_t jump_table[] =
|
||||
|
||||
/* Handle positional format specifiers. */
|
||||
static void printf_positional (struct Xprintf_buffer *buf,
|
||||
const CHAR_T *format, int readonly_format,
|
||||
const CHAR_T *format,
|
||||
enum readonly_error_type readonly_format,
|
||||
va_list ap, va_list *ap_savep,
|
||||
int nspecs_done, const UCHAR_T *lead_str_end,
|
||||
CHAR_T *work_buffer, int save_errno,
|
||||
@@ -626,9 +627,7 @@ Xprintf_buffer (struct Xprintf_buffer *buf, const CHAR_T *format,
|
||||
/* For the %m format we may need the current `errno' value. */
|
||||
int save_errno = errno;
|
||||
|
||||
/* 1 if format is in read-only memory, -1 if it is in writable memory,
|
||||
0 if unknown. */
|
||||
int readonly_format = 0;
|
||||
enum readonly_error_type readonly_format = readonly_noerror;
|
||||
|
||||
/* Initialize local variables. */
|
||||
grouping = (const char *) -1;
|
||||
@@ -1045,7 +1044,7 @@ do_positional:
|
||||
|
||||
static void
|
||||
printf_positional (struct Xprintf_buffer * buf, const CHAR_T *format,
|
||||
int readonly_format,
|
||||
enum readonly_error_type readonly_format,
|
||||
va_list ap, va_list *ap_savep, int nspecs_done,
|
||||
const UCHAR_T *lead_str_end,
|
||||
CHAR_T *work_buffer, int save_errno,
|
||||
|
Reference in New Issue
Block a user