[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+bHwpoS+i-zwJCma6U94Hj_+DuBssJpGfPOm7gPDQVEznuMLA@mail.gmail.com>
Date: Wed, 17 Feb 2016 04:15:33 -0500
From: Hugues Bruant <hugues@...ofs.com>
To: musl@...ts.openwall.com
Subject: Re: dynlink.c: bug in reclaim_gaps leading to segfault in __libc_exit_fini
Finally figured it out:
1. musl is reclaiming space from the executable starting at offset
0x224B20, i.e. at the end of the bss
2. this reclaimed space gets used for the dso struct of the first shared lib
3. the last variable in the bss appears to be scratch space for checksum
computation
4. the code is assuming "unsigned long" to be 4 bytes, which isn't the case
on 64bit platforms
5. the checksum code overflows out of the bss, corrupting the dso struct
6. this issue is masked in a glibc environment because the loader doesn't
make the unused part of the program pages available to malloc.
7. valgrind doesn't catch the problem because it doesn't bound-check globals
Sorry about the noise.
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
