ldconfig: file truncated while reading soname after patchelf [BZ #23964]

Message ID 76bf070f-8be1-6874-e284-7988505cb261@coughlan.de
State New, archived
Headers

Commit Message

Eamonn Coughlan Dec. 8, 2018, 7:59 p.m. UTC
  The way loadaddr is computed from the first LOAD segment in
process_elf_file assumes .dynstr is also contained in that segment. That
is not necessarily true, especially for libraries that have been touched
by patchelf.

With this patch, the address read from the dynamic segment is checked
against all applicable segments instead of only the first one.

        [BZ #23964]
        * elf/readelflib.c: Fix resolving of loadaddr for .dynstr vaddr.
---
  elf/readelflib.c | 33 ++++++++++++++++-----------------
  1 file changed, 16 insertions(+), 17 deletions(-)

             error (0, 0, _("more than one dynamic segment\n"));
@@ -176,11 +171,6 @@ process_elf_file (const char *file_name, const char 
*lib, int *flag,
         }

      }
-  if (loadaddr == (ElfW(Addr)) -1)
-    {
-      /* Very strange. */
-      loadaddr = 0;
-    }

    /* Now we can read the dynamic sections.  */
    if (dynamic_size == 0)
@@ -190,22 +180,31 @@ process_elf_file (const char *file_name, const 
char *lib, int *flag,
    check_ptr (dynamic_segment);

    /* Find the string table.  */
-  dynamic_strings = NULL;
    for (dyn_entry = dynamic_segment; dyn_entry->d_tag != DT_NULL;
         ++dyn_entry)
      {
        check_ptr (dyn_entry);
        if (dyn_entry->d_tag == DT_STRTAB)
-       {
-         dynamic_strings = (char *) (file_contents + 
dyn_entry->d_un.d_val - loadaddr);
-         check_ptr (dynamic_strings);
-         break;
-       }
+        break;
      }

-  if (dynamic_strings == NULL)
+  for (i = 0, segment = elf_pheader;i < elf_header->e_phnum; i++, 
segment++)
+  {
+    ElfW(Addr) vaddr = dyn_entry->d_un.d_ptr;
+    if (segment->p_type == PT_LOAD &&
+        vaddr >= segment->p_vaddr &&
+        vaddr < segment->p_vaddr + segment->p_filesz)
+    {
+      loadaddr = segment->p_vaddr - segment->p_offset;
+      break;
+    }
+  }
+  if (loadaddr == (ElfW(Addr)) -1)
      return 1;

+  dynamic_strings = (char *) (file_contents + dyn_entry->d_un.d_val - 
loadaddr);
+  check_ptr (dynamic_strings);
+
    /* Now read the DT_NEEDED and DT_SONAME entries.  */
    for (dyn_entry = dynamic_segment; dyn_entry->d_tag != DT_NULL;
         ++dyn_entry)
  

Patch

diff --git a/elf/readelflib.c b/elf/readelflib.c
index 5a1e2dc2df..bc1195c175 100644


--- a/elf/readelflib.c
+++ b/elf/readelflib.c
@@ -98,11 +98,6 @@  process_elf_file (const char *file_name, const char 
*lib, int *flag,

        switch (segment->p_type)
         {
-       case PT_LOAD:
-         if (loadaddr == (ElfW(Addr)) -1)
-           loadaddr = segment->p_vaddr - segment->p_offset;
-         break;
-
         case PT_DYNAMIC:
           if (dynamic_addr)