[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <3C00D395-838B-4DB0-99FC-3947F1BCF054@icloud.com>
Date: Sun, 30 Aug 2020 17:34:09 -0700
From: Theodore Dubois <tblodt@...oud.com>
To: musl@...ts.openwall.com
Subject: i386 __set_thread_area will crash if the syscall fails
Found a (small) bug in this file: https://git.musl-libc.org/cgit/musl/tree/src/thread/i386/__set_thread_area.s
If the syscall fails, the branch on line 20 is taken and %eax will be a small negative number. Then "mov $123,%al" will make syscall 0xffffff7b instead of 0x7b, since overwriting %al only overwrites the low byte of %eax. So the modify_ldt fallback has apparently never worked.
Tangentially, I'm not sure why this file has so many hardcoded magic numbers and no comments to explain what they are.
~Theodore
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
