d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a twelve year old bug in readelf: when process_dynamic_segment()

Browse Source 
encounters a DT_RUNPATH entry, the global dynamic_info[] array is
overrun, causing some other global variable to be overwritten.

In my testcase, this was the section_headers variable, leading to
segfaults or jemalloc assertions when it was freed later on.

Thanks to Koop Mast for providing samples of a few "bad" .so files.

MFC after:	1 week
This commit is contained in:
Dimitry Andric 2012-08-31 23:28:41 +00:00
parent f66dc62abf
commit 6a1fba3556
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=239962
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/binutils/binutils/readelf.c
View File

@ -174,7 +174,7 @@ static Elf_Internal_Syminfo *dynamic_syminfo;
static unsigned long dynamic_syminfo_offset;
static unsigned int dynamic_syminfo_nent;
static char program_interpreter[PATH_MAX];
static bfd_vma dynamic_info[DT_JMPREL + 1];
static bfd_vma dynamic_info[DT_ENCODING];
static bfd_vma dynamic_info_DT_GNU_HASH;
static bfd_vma version_info[16];
static Elf_Internal_Ehdr elf_header;