commit 62058ce612ed3459501b4c4332e268edfe977f59 Author: Carlos O'Donell Date: Mon Sep 29 13:14:21 2014 -0400 Correctly size profiling reloc table (bug 17411) During auditing or profiling modes the dynamic loader builds a cache of the relocated PLT entries in order to reuse them when called again through the same PLT entry. This way the PLT entry is never completed and the call into the resolver always results in profiling or auditing code running. The problem is that the PLT relocation cache size is not computed correctly. The size of the cache should be "Size of a relocation result structure" x "Number of PLT-related relocations". Instead the code erroneously computes "Size of a relocation result" x "Number of bytes worth of PLT-related relocations". I can only assume this was a mistake in the understanding of the value of DT_PLTRELSZ which is the number of bytes of PLT-related relocs. We do have a DT_RELACOUNT entry, which is a count for dynamic relative relocs, but we have no DT_PLTRELCOUNT and thus we need to compute it. This patch corrects the computation of the size of the relocation table used by the glibc profiling code. For more details see: https://sourceware.org/ml/libc-alpha/2014-09/msg00513.html [BZ #17411] * elf/dl-reloc.c (_dl_relocate_object): Allocate correct amount for l_reloc_result. diff --git glibc-2.17-c758a686/elf/dl-reloc.c glibc-2.17-c758a686/elf/dl-reloc.c index d2c6dac..97a7119 100644 --- glibc-2.17-c758a686/elf/dl-reloc.c +++ glibc-2.17-c758a686/elf/dl-reloc.c @@ -279,8 +279,12 @@ _dl_relocate_object (struct link_map *l, struct r_scope_elem *scope[], l->l_name); } - l->l_reloc_result = calloc (sizeof (l->l_reloc_result[0]), - l->l_info[DT_PLTRELSZ]->d_un.d_val); + size_t sizeofrel = l->l_info[DT_PLTREL]->d_un.d_val == DT_RELA + ? sizeof (ElfW(Rela)) + : sizeof (ElfW(Rel)); + size_t relcount = l->l_info[DT_PLTRELSZ]->d_un.d_val / sizeofrel; + l->l_reloc_result = calloc (sizeof (l->l_reloc_result[0]), relcount); + if (l->l_reloc_result == NULL) { errstring = N_("\