Date: Wed, 03 Jan 2018 20:10:45 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 224875] kldxref fails if a mod_depend md_cval is too close to the end of allocated sections Message-ID: <bug-224875-8@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D224875 Bug ID: 224875 Summary: kldxref fails if a mod_depend md_cval is too close to the end of allocated sections Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: bin Assignee: freebsd-bugs@FreeBSD.org Reporter: emaste@freebsd.org In kldxref.c:read_kld() we have a 33-byte cval buffer: char ... cval[MAXMODNAME + 1] ... into which we read a string: check(EF_SEG_READ(&ef, (Elf_Off)md.md_cval, sizeof(cval), cval)); This requires that a 33-byte read is successful, however it may fail if the string is shorter than 32 characters (plus the NUL) and is located near the highest allocated address. It appears this has never been an issue with ld.bfd, which places a loadable .comment section after other sections of interest, so kldxref is free to re= ad unrelated data beyond the end of the cval string. ld.lld however places .comment early in the section list, and so the cval m= ay be in a .data or .rodata section that comes at the end of the section list. (CTF data may also be after .data/.rodata and would mitigate this issue; it= may happen only with CTF disabled) --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-224875-8>