0004-nativesdk-glibc-Fix-buffer-overrun-with-a-relocated-.patch 1.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546
  1. From c3492719b2deaf3339eefb1ab30f4337e592ed80 Mon Sep 17 00:00:00 2001
  2. From: Khem Raj <raj.khem@gmail.com>
  3. Date: Wed, 18 Mar 2015 01:50:00 +0000
  4. Subject: [PATCH] nativesdk-glibc: Fix buffer overrun with a relocated SDK
  5. When ld-linux-*.so.2 is relocated to a path that is longer than the
  6. original fixed location, the dynamic loader will crash in open_path
  7. because it implicitly assumes that max_dirnamelen is a fixed size that
  8. never changes.
  9. The allocated buffer will not be large enough to contain the directory
  10. path string which is larger than the fixed location provided at build
  11. time.
  12. Upstream-Status: Inappropriate [OE SDK specific]
  13. Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
  14. Signed-off-by: Khem Raj <raj.khem@gmail.com>
  15. ---
  16. elf/dl-load.c | 12 ++++++++++++
  17. 1 file changed, 12 insertions(+)
  18. diff --git a/elf/dl-load.c b/elf/dl-load.c
  19. index 0a6fa9b8f0..3a23dc618c 100644
  20. --- a/elf/dl-load.c
  21. +++ b/elf/dl-load.c
  22. @@ -1802,7 +1802,19 @@ open_path (const char *name, size_t namelen, int mode,
  23. given on the command line when rtld is run directly. */
  24. return -1;
  25. + do
  26. + {
  27. + struct r_search_path_elem *this_dir = *dirs;
  28. + if (this_dir->dirnamelen > max_dirnamelen)
  29. + {
  30. + max_dirnamelen = this_dir->dirnamelen;
  31. + }
  32. + }
  33. + while (*++dirs != NULL);
  34. +
  35. buf = alloca (max_dirnamelen + max_capstrlen + namelen);
  36. +
  37. + dirs = sps->dirs;
  38. do
  39. {
  40. struct r_search_path_elem *this_dir = *dirs;