d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rtld: Handle ELF dso with program headers outside the first page.

Browse Source 
Reported by:	Alex Arslan <alex.arslan@julialang.org>
PR:	229708
Reviewed by:	dim (previous version), emaste
Sponsored by:	The FreeBSD Foundation
Differential revision:	https://reviews.freebsd.org/D26323
This commit is contained in:
Konstantin Belousov 2020-09-05 10:16:24 +00:00
parent 84961358b4
commit 5d6d106cf6
1 changed files with 28 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
libexec/rtld-elf/map_object.c
View File

@ -40,11 +40,19 @@
#include "debug.h" #include "debug.h"
#include "rtld.h" #include "rtld.h"
static Elf_Ehdr *get_elf_header(int, const char *, const struct stat *); static Elf_Ehdr *get_elf_header(int, const char *, const struct stat *,
Elf_Phdr **phdr);
static int convert_flags(int); /* Elf flags -> mmap flags */ static int convert_flags(int); /* Elf flags -> mmap flags */
int __getosreldate(void); int __getosreldate(void);
static bool
phdr_in_zero_page(const Elf_Ehdr *hdr)
{
return (hdr->e_phoff + hdr->e_phnum * sizeof(Elf_Phdr) <
(size_t)PAGE_SIZE);
}
/* /*
* Map a shared object into memory. The "fd" argument is a file descriptor, * Map a shared object into memory. The "fd" argument is a file descriptor,
* which must be open on the object and positioned at its beginning. * which must be open on the object and positioned at its beginning.
@ -95,17 +103,15 @@ map_object(int fd, const char *path, const struct stat *sb)
size_t note_map_len; size_t note_map_len;
Elf_Addr text_end; Elf_Addr text_end;
hdr = get_elf_header(fd, path, sb); hdr = get_elf_header(fd, path, sb, &phdr);
if (hdr == NULL) if (hdr == NULL)
return (NULL); return (NULL);
/* /*
* Scan the program header entries, and save key information. * Scan the program header entries, and save key information.
*
* We expect that the loadable segments are ordered by load address. * We expect that the loadable segments are ordered by load address.
*/ */
phdr = (Elf_Phdr *)((char *)hdr + hdr->e_phoff); phsize = hdr->e_phnum * sizeof(phdr[0]);
phsize = hdr->e_phnum * sizeof (phdr[0]);
phlimit = phdr + hdr->e_phnum; phlimit = phdr + hdr->e_phnum;
nsegs = -1; nsegs = -1;
phdyn = phinterp = phtls = NULL; phdyn = phinterp = phtls = NULL;
@ -332,14 +338,18 @@ error1:
error: error:
if (note_map != NULL && note_map != MAP_FAILED) if (note_map != NULL && note_map != MAP_FAILED)
munmap(note_map, note_map_len); munmap(note_map, note_map_len);
if (!phdr_in_zero_page(hdr))
munmap(phdr, hdr->e_phnum * sizeof(phdr[0]));
munmap(hdr, PAGE_SIZE); munmap(hdr, PAGE_SIZE);
return (NULL); return (NULL);
} }
static Elf_Ehdr * static Elf_Ehdr *
get_elf_header(int fd, const char *path, const struct stat *sbp) get_elf_header(int fd, const char *path, const struct stat *sbp,
Elf_Phdr **phdr_p)
{ {
Elf_Ehdr *hdr; Elf_Ehdr *hdr;
Elf_Phdr *phdr;
/* Make sure file has enough data for the ELF header */ /* Make sure file has enough data for the ELF header */
if (sbp != NULL && sbp->st_size < (off_t)sizeof(Elf_Ehdr)) { if (sbp != NULL && sbp->st_size < (off_t)sizeof(Elf_Ehdr)) {
@ -388,11 +398,19 @@ get_elf_header(int fd, const char *path, const struct stat *sbp)
"%s: invalid shared object: e_phentsize != sizeof(Elf_Phdr)", path); "%s: invalid shared object: e_phentsize != sizeof(Elf_Phdr)", path);
goto error; goto error;
} }
if (hdr->e_phoff + hdr->e_phnum * sizeof(Elf_Phdr) > if (phdr_in_zero_page(hdr)) {
(size_t)PAGE_SIZE) { phdr = (Elf_Phdr *)((char *)hdr + hdr->e_phoff);
_rtld_error("%s: program header too large", path); } else {
goto error; phdr = mmap(NULL, hdr->e_phnum * sizeof(phdr[0]),
PROT_READ, MAP_PRIVATE | MAP_PREFAULT_READ, fd,
hdr->e_phoff);
if (phdr == MAP_FAILED) {
_rtld_error("%s: error mapping phdr: %s", path,
rtld_strerror(errno));
goto error;
}
} }
*phdr_p = phdr;
return (hdr); return (hdr);
error: error: