|
 |
28653a |
commit 33e03f9cd2be4f2cd62f93fda539cc07d9c8130e
|
|
|
28653a |
Author: Joan Bruguera <joanbrugueram@gmail.com>
|
|
|
28653a |
Date: Mon Apr 11 19:49:56 2022 +0200
|
|
|
28653a |
|
|
|
28653a |
misc: Fix rare fortify crash on wchar funcs. [BZ 29030]
|
|
|
28653a |
|
|
|
28653a |
If `__glibc_objsize (__o) == (size_t) -1` (i.e. `__o` is unknown size), fortify
|
|
|
28653a |
checks should pass, and `__whatever_alias` should be called.
|
|
|
28653a |
|
|
|
28653a |
Previously, `__glibc_objsize (__o) == (size_t) -1` was explicitly checked, but
|
|
|
28653a |
on commit a643f60c53876b, this was moved into `__glibc_safe_or_unknown_len`.
|
|
|
28653a |
|
|
|
28653a |
A comment says the -1 case should work as: "The -1 check is redundant because
|
|
|
28653a |
since it implies that __glibc_safe_len_cond is true.". But this fails when:
|
|
|
28653a |
* `__s > 1`
|
|
|
28653a |
* `__osz == -1` (i.e. unknown size at compile time)
|
|
|
28653a |
* `__l` is big enough
|
|
|
28653a |
* `__l * __s <= __osz` can be folded to a constant
|
|
|
28653a |
(I only found this to be true for `mbsrtowcs` and other functions in wchar2.h)
|
|
|
28653a |
|
|
|
28653a |
In this case `__l * __s <= __osz` is false, and `__whatever_chk_warn` will be
|
|
|
28653a |
called by `__glibc_fortify` or `__glibc_fortify_n` and crash the program.
|
|
|
28653a |
|
|
|
28653a |
This commit adds the explicit `__osz == -1` check again.
|
|
|
28653a |
moc crashes on startup due to this, see: https://bugs.archlinux.org/task/74041
|
|
|
28653a |
|
|
|
28653a |
Minimal test case (test.c):
|
|
|
28653a |
#include <wchar.h>
|
|
|
28653a |
|
|
|
28653a |
int main (void)
|
|
|
28653a |
{
|
|
|
28653a |
const char *hw = "HelloWorld";
|
|
|
28653a |
mbsrtowcs (NULL, &hw, (size_t)-1, NULL);
|
|
|
28653a |
return 0;
|
|
|
28653a |
}
|
|
|
28653a |
|
|
|
28653a |
Build with:
|
|
|
28653a |
gcc -O2 -Wp,-D_FORTIFY_SOURCE=2 test.c -o test && ./test
|
|
|
28653a |
|
|
|
28653a |
Output:
|
|
|
28653a |
*** buffer overflow detected ***: terminated
|
|
|
28653a |
|
|
|
28653a |
Fixes: BZ #29030
|
|
|
28653a |
Signed-off-by: Joan Bruguera <joanbrugueram@gmail.com>
|
|
|
28653a |
Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
|
|
|
28653a |
|
|
|
28653a |
diff --git a/debug/tst-fortify.c b/debug/tst-fortify.c
|
|
|
28653a |
index 1668294e48b5c63c..701bffd1d664f289 100644
|
|
|
28653a |
--- a/debug/tst-fortify.c
|
|
|
28653a |
+++ b/debug/tst-fortify.c
|
|
|
28653a |
@@ -1505,6 +1505,11 @@ do_test (void)
|
|
|
28653a |
CHK_FAIL_END
|
|
|
28653a |
#endif
|
|
|
28653a |
|
|
|
28653a |
+ /* Bug 29030 regresion check */
|
|
|
28653a |
+ cp = "HelloWorld";
|
|
|
28653a |
+ if (mbsrtowcs (NULL, &cp, (size_t)-1, &s) != 10)
|
|
|
28653a |
+ FAIL ();
|
|
|
28653a |
+
|
|
|
28653a |
cp = "A";
|
|
|
28653a |
if (mbstowcs (wenough, cp, 10) != 1
|
|
|
28653a |
|| wcscmp (wenough, L"A") != 0)
|
|
|
28653a |
diff --git a/misc/sys/cdefs.h b/misc/sys/cdefs.h
|
|
|
28653a |
index a17ae0ed87e6163f..404496c7d6da4fb3 100644
|
|
|
28653a |
--- a/misc/sys/cdefs.h
|
|
|
28653a |
+++ b/misc/sys/cdefs.h
|
|
|
28653a |
@@ -143,13 +143,13 @@
|
|
|
28653a |
|| (__builtin_constant_p (__l) && (__l) > 0))
|
|
|
28653a |
|
|
|
28653a |
/* Length is known to be safe at compile time if the __L * __S <= __OBJSZ
|
|
|
28653a |
- condition can be folded to a constant and if it is true. The -1 check is
|
|
|
28653a |
- redundant because since it implies that __glibc_safe_len_cond is true. */
|
|
|
28653a |
+ condition can be folded to a constant and if it is true, or unknown (-1) */
|
|
|
28653a |
#define __glibc_safe_or_unknown_len(__l, __s, __osz) \
|
|
|
28653a |
- (__glibc_unsigned_or_positive (__l) \
|
|
|
28653a |
- && __builtin_constant_p (__glibc_safe_len_cond ((__SIZE_TYPE__) (__l), \
|
|
|
28653a |
- __s, __osz)) \
|
|
|
28653a |
- && __glibc_safe_len_cond ((__SIZE_TYPE__) (__l), __s, __osz))
|
|
|
28653a |
+ ((__osz) == (__SIZE_TYPE__) -1 \
|
|
|
28653a |
+ || (__glibc_unsigned_or_positive (__l) \
|
|
|
28653a |
+ && __builtin_constant_p (__glibc_safe_len_cond ((__SIZE_TYPE__) (__l), \
|
|
|
28653a |
+ (__s), (__osz))) \
|
|
|
28653a |
+ && __glibc_safe_len_cond ((__SIZE_TYPE__) (__l), (__s), (__osz))))
|
|
|
28653a |
|
|
|
28653a |
/* Conversely, we know at compile time that the length is unsafe if the
|
|
|
28653a |
__L * __S <= __OBJSZ condition can be folded to a constant and if it is
|