glibc/glibc-rh741105.patch
2015-10-21 15:24:28 -04:00

74 lines
2.6 KiB
Diff

Index: glibc-2.22-386-g95e8397/elf/dl-load.c
===================================================================
--- glibc-2.22-386-g95e8397.orig/elf/dl-load.c
+++ glibc-2.22-386-g95e8397/elf/dl-load.c
@@ -881,7 +881,8 @@ _dl_map_object_from_fd (const char *name
/* Get file information. */
struct r_file_id id;
- if (__glibc_unlikely (!_dl_get_file_id (fd, &id)))
+ struct stat64 st;
+ if (__glibc_unlikely (!_dl_get_file_id (fd, &id, &st)))
{
errstring = N_("cannot stat shared object");
call_lose_errno:
@@ -1076,6 +1077,16 @@ _dl_map_object_from_fd (const char *name
= N_("ELF load command address/offset not properly aligned");
goto call_lose;
}
+ if (__glibc_unlikely (ph->p_offset + ph->p_filesz > st.st_size))
+ {
+ /* If the segment requires zeroing of part of its last
+ page, we'll crash when accessing the unmapped page.
+ There's still a possibility of a race, if the shared
+ object is truncated between the fxstat above and the
+ memset below. */
+ errstring = N_("ELF load command past end of file");
+ goto call_lose;
+ }
struct loadcmd *c = &loadcmds[nloadcmds++];
c->mapstart = ALIGN_DOWN (ph->p_vaddr, GLRO(dl_pagesize));
Index: glibc-2.22-386-g95e8397/sysdeps/generic/dl-fileid.h
===================================================================
--- glibc-2.22-386-g95e8397.orig/sysdeps/generic/dl-fileid.h
+++ glibc-2.22-386-g95e8397/sysdeps/generic/dl-fileid.h
@@ -29,7 +29,8 @@ struct r_file_id
On error, returns false, with errno set. */
static inline bool
_dl_get_file_id (int fd __attribute__ ((unused)),
- struct r_file_id *id __attribute__ ((unused)))
+ struct r_file_id *id __attribute__ ((unused)),
+ struct stat64_t *st __attribute__((unused)))
{
return true;
}
Index: glibc-2.22-386-g95e8397/sysdeps/posix/dl-fileid.h
===================================================================
--- glibc-2.22-386-g95e8397.orig/sysdeps/posix/dl-fileid.h
+++ glibc-2.22-386-g95e8397/sysdeps/posix/dl-fileid.h
@@ -27,18 +27,16 @@ struct r_file_id
ino64_t ino;
};
-/* Sample FD to fill in *ID. Returns true on success.
+/* Sample FD to fill in *ID and *ST. Returns true on success.
On error, returns false, with errno set. */
static inline bool
-_dl_get_file_id (int fd, struct r_file_id *id)
+_dl_get_file_id (int fd, struct r_file_id *id, struct stat64 *st)
{
- struct stat64 st;
-
- if (__glibc_unlikely (__fxstat64 (_STAT_VER, fd, &st) < 0))
+ if (__glibc_unlikely (__fxstat64 (_STAT_VER, fd, st) < 0))
return false;
- id->dev = st.st_dev;
- id->ino = st.st_ino;
+ id->dev = st->st_dev;
+ id->ino = st->st_ino;
return true;
}