|
|
0f798c |
From fba95ad936f1d8c1052259bae811f1fc07f9a215 Mon Sep 17 00:00:00 2001
|
|
|
0f798c |
From: Petr Machata <pmachata@redhat.com>
|
|
|
0f798c |
Date: Thu, 30 Oct 2014 01:48:17 +0100
|
|
|
0f798c |
Subject: [PATCH] Initialize the PLT slot map correctly on x86 and x86_64
|
|
|
0f798c |
|
|
|
0f798c |
The PLT slot map translates relocation numbers to PLT slot numbers,
|
|
|
0f798c |
but was actually initialized in the opposite direction. Fix the way
|
|
|
0f798c |
it's initialized. This bug can be seen on glibc in particular:
|
|
|
0f798c |
|
|
|
0f798c |
$ ltrace -e free ls
|
|
|
0f798c |
libc.so.6->free(0x5) = <void>
|
|
|
0f798c |
libc.so.6->free(0x78) = <void>
|
|
|
0f798c |
libc.so.6->free(0xc) = <void>
|
|
|
0f798c |
libc.so.6->free(0x308) = <void>
|
|
|
0f798c |
|
|
|
0f798c |
Note the nonsense values passed to free. The problem is that these
|
|
|
0f798c |
are not free calls at all, but malloc calls that are assigned to wrong
|
|
|
0f798c |
PLT slots due to above bug.
|
|
|
0f798c |
---
|
|
|
0f798c |
sysdeps/linux-gnu/x86/plt.c | 38 +++++++++++++++++++++-----------------
|
|
|
0f798c |
1 file changed, 21 insertions(+), 17 deletions(-)
|
|
|
0f798c |
|
|
|
0f798c |
diff --git a/sysdeps/linux-gnu/x86/plt.c b/sysdeps/linux-gnu/x86/plt.c
|
|
|
0f798c |
index c860af6..97f6c3e 100644
|
|
|
0f798c |
--- a/sysdeps/linux-gnu/x86/plt.c
|
|
|
0f798c |
+++ b/sysdeps/linux-gnu/x86/plt.c
|
|
|
0f798c |
@@ -77,6 +77,18 @@ arch_elf_init(struct ltelf *lte, struct library *lib)
|
|
|
0f798c |
{
|
|
|
0f798c |
VECT_INIT(<e->arch.plt_map, unsigned int);
|
|
|
0f798c |
|
|
|
0f798c |
+ if (vect_reserve(<e->arch.plt_map, vect_size(<e->plt_relocs)) < 0) {
|
|
|
0f798c |
+ fail:
|
|
|
0f798c |
+ arch_elf_destroy(lte);
|
|
|
0f798c |
+ return -1;
|
|
|
0f798c |
+ }
|
|
|
0f798c |
+
|
|
|
0f798c |
+ {
|
|
|
0f798c |
+ unsigned int i, sz = vect_size(<e->plt_relocs);
|
|
|
0f798c |
+ for (i = 0; i < sz; ++i)
|
|
|
0f798c |
+ vect_pushback (<e->arch.plt_map, &i);
|
|
|
0f798c |
+ }
|
|
|
0f798c |
+
|
|
|
0f798c |
/* IRELATIVE slots may make the whole situation a fair deal
|
|
|
0f798c |
* more complex. On x86{,_64}, the PLT slots are not
|
|
|
0f798c |
* presented in the order of the corresponding relocations,
|
|
|
0f798c |
@@ -114,43 +126,35 @@ arch_elf_init(struct ltelf *lte, struct library *lib)
|
|
|
0f798c |
/* Here we scan the PLT table and initialize a map of
|
|
|
0f798c |
* relocation->slot number in lte->arch.plt_map. */
|
|
|
0f798c |
|
|
|
0f798c |
- size_t i;
|
|
|
0f798c |
- for (i = 0; i < vect_size(<e->plt_relocs); ++i) {
|
|
|
0f798c |
+ unsigned int i, sz = vect_size(<e->plt_relocs);
|
|
|
0f798c |
+ for (i = 0; i < sz; ++i) {
|
|
|
0f798c |
|
|
|
0f798c |
GElf_Addr offset = x86_plt_offset(i);
|
|
|
0f798c |
- uint32_t reloc_arg = 0;
|
|
|
0f798c |
|
|
|
0f798c |
uint8_t byte;
|
|
|
0f798c |
if (elf_read_next_u8(lte->plt_data, &offset, &byte) < 0
|
|
|
0f798c |
|| byte != 0xff
|
|
|
0f798c |
|| elf_read_next_u8(lte->plt_data, &offset, &byte) < 0
|
|
|
0f798c |
|| (byte != 0xa3 && byte != 0x25))
|
|
|
0f798c |
- goto next;
|
|
|
0f798c |
+ continue;
|
|
|
0f798c |
|
|
|
0f798c |
/* Skip immediate argument in the instruction. */
|
|
|
0f798c |
offset += 4;
|
|
|
0f798c |
|
|
|
0f798c |
+ uint32_t reloc_arg;
|
|
|
0f798c |
if (elf_read_next_u8(lte->plt_data, &offset, &byte) < 0
|
|
|
0f798c |
|| byte != 0x68
|
|
|
0f798c |
|| elf_read_next_u32(lte->plt_data,
|
|
|
0f798c |
- &offset, &reloc_arg) < 0) {
|
|
|
0f798c |
- reloc_arg = 0;
|
|
|
0f798c |
- goto next;
|
|
|
0f798c |
- }
|
|
|
0f798c |
+ &offset, &reloc_arg) < 0)
|
|
|
0f798c |
+ continue;
|
|
|
0f798c |
|
|
|
0f798c |
if (lte->ehdr.e_machine == EM_386) {
|
|
|
0f798c |
- if (reloc_arg % 8 != 0) {
|
|
|
0f798c |
- reloc_arg = 0;
|
|
|
0f798c |
- goto next;
|
|
|
0f798c |
- }
|
|
|
0f798c |
+ if (reloc_arg % 8 != 0)
|
|
|
0f798c |
+ continue;
|
|
|
0f798c |
reloc_arg /= 8;
|
|
|
0f798c |
}
|
|
|
0f798c |
|
|
|
0f798c |
- next:
|
|
|
0f798c |
- if (VECT_PUSHBACK(<e->arch.plt_map, &reloc_arg) < 0) {
|
|
|
0f798c |
- arch_elf_destroy(lte);
|
|
|
0f798c |
- return -1;
|
|
|
0f798c |
- }
|
|
|
0f798c |
+ *VECT_ELEMENT(<e->arch.plt_map, unsigned int, reloc_arg) = i;
|
|
|
0f798c |
}
|
|
|
0f798c |
|
|
|
0f798c |
return 0;
|
|
|
0f798c |
--
|
|
|
0f798c |
2.1.0
|
|
|
0f798c |
|