From owner-freebsd-current@FreeBSD.ORG Mon Aug 1 20:16:56 2005 Return-Path: X-Original-To: freebsd-current@freebsd.org Delivered-To: freebsd-current@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5AADB16A41F for ; Mon, 1 Aug 2005 20:16:56 +0000 (GMT) (envelope-from jhb@FreeBSD.org) Received: from mv.twc.weather.com (mv.twc.weather.com [65.212.71.225]) by mx1.FreeBSD.org (Postfix) with ESMTP id E833443D48 for ; Mon, 1 Aug 2005 20:16:55 +0000 (GMT) (envelope-from jhb@FreeBSD.org) Received: from [10.50.40.201] (Not Verified[65.202.103.25]) by mv.twc.weather.com with NetIQ MailMarshal (v6, 0, 3, 8) id ; Mon, 01 Aug 2005 16:31:30 -0400 From: John Baldwin To: freebsd-current@freebsd.org Date: Mon, 1 Aug 2005 15:14:13 -0400 User-Agent: KMail/1.8 References: <20050728000152.871E026@mero.morphisms.net> In-Reply-To: <20050728000152.871E026@mero.morphisms.net> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-6" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <200508011514.14346.jhb@FreeBSD.org> Cc: William Josephson Subject: Re: dlinfo/rtld.c bug X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 01 Aug 2005 20:16:56 -0000 On Wednesday 27 July 2005 08:01 pm, William Josephson wrote: > I've run across a bug in the ELF dynamic linker in FreeBSD 4.x > and FreeBSD 5.4. Although I haven't had a chance to compile or > install FreeBSD 6 yet, the bug appears to be in the ELF dynamic > linker in at least FreeBSD 4 through -CURRENT. The problem is > that do_search_info in libexec/rtld-elf/rtld.c does not account > for the space required by Dl_serpath structures with either the > RTLD_DI_SERINFOSIZE, or the RTLD_DI_SERINFO requests. The > example program in the dlinfo man page happens to work, but a > simple loop copying the path strings into a buffer allocated with > malloc will corrupt the heap. The program below illustrates the > problem. Given that the arithmetic in do_search_info is easily > fixed, it might be worth patching before the upcoming release. > > #include > #include > #include > #include > > int > main(int argc, char *argv[]) > { > char *s; > Dl_serinfo *p; > Dl_serinfo info; > > memset(&info, 0, sizeof(info)); > dlinfo(RTLD_SELF, RTLD_DI_SERINFOSIZE, (void*)&info); > p = malloc(info.dls_size); > memset(p, 0, info.dls_size); > p->dls_cnt = info.dls_cnt; > p->dls_size = info.dls_size; > dlinfo(RTLD_SELF, RTLD_DI_SERINFO, (void*)p); > s = p->dls_serpath[p->dls_cnt-1].dls_name; > s += strlen(s)+1; > printf("%d %d %d %d %d\n", info.dls_size, (char*)s-(char*)p, > ((char*)s-(char*)p)-info.dls_size, sizeof(Dl_serpath), > info.dls_cnt*sizeof(Dl_serpath)); > return 0; > } Do you have a patch for this? -- John Baldwin <>< http://www.FreeBSD.org/~jhb/ "Power Users Use the Power to Serve" = http://www.FreeBSD.org