Patrick Williams | c124f4f | 2015-09-15 14:41:29 -0500 | [diff] [blame] | 1 | debugedit: fix segment fault while file's bss offset have a large number |
| 2 | |
| 3 | While ELF_C_RDWR_MMAP was used, elf_begin invoked mmap() to map file |
| 4 | into memory. While the file's bss Offset has a large number, elf_update |
| 5 | caculated file size by __elf64_updatenull_wrlock and the size was |
| 6 | enlarged. |
| 7 | |
| 8 | In this situation, elf_update invoked ftruncate to enlarge the file, |
| 9 | and memory size (elf->maximum_size) also was incorrectly updated. |
| 10 | There was segment fault in elf_end which invoked munmap with the |
| 11 | length is the enlarged file size, not the mmap's length. |
| 12 | |
| 13 | Before the above operations, invoke elf_begin/elf_update/elf_end |
| 14 | with ELF_C_RDWR and ELF_F_LAYOUT set to enlarge the above file, it |
| 15 | could make sure the file is safe for the following elf operations. |
| 16 | |
| 17 | Upstream-Status: Pending |
| 18 | Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> |
| 19 | --- |
| 20 | tools/debugedit.c | 25 +++++++++++++++++++++++++ |
| 21 | 1 file changed, 25 insertions(+) |
| 22 | |
| 23 | Index: rpm-5.4.14/tools/debugedit.c |
| 24 | =================================================================== |
| 25 | --- rpm-5.4.14.orig/tools/debugedit.c |
| 26 | +++ rpm-5.4.14/tools/debugedit.c |
| 27 | @@ -1525,6 +1525,28 @@ handle_build_id (DSO *dso, Elf_Data *bui |
| 28 | } |
| 29 | } |
| 30 | |
| 31 | +/* It avoided the segment fault while file's bss offset have a large number. |
| 32 | + See https://bugzilla.redhat.com/show_bug.cgi?id=1019707 |
| 33 | + https://bugzilla.redhat.com/show_bug.cgi?id=1020842 for detail. */ |
| 34 | +void valid_file(int fd) |
| 35 | +{ |
| 36 | + Elf *elf = elf_begin (fd, ELF_C_RDWR, NULL); |
| 37 | + if (elf == NULL) |
| 38 | + { |
| 39 | + error (1, 0, "elf_begin: %s", elf_errmsg (-1)); |
| 40 | + return; |
| 41 | + } |
| 42 | + |
| 43 | + elf_flagelf (elf, ELF_C_SET, ELF_F_LAYOUT); |
| 44 | + |
| 45 | + if (elf_update (elf, ELF_C_WRITE) < 0) |
| 46 | + error (1, 0, "elf_update: %s", elf_errmsg (-1)); |
| 47 | + |
| 48 | + elf_end (elf); |
| 49 | + |
| 50 | + return; |
| 51 | +} |
| 52 | + |
| 53 | int |
| 54 | main (int argc, char *argv[]) |
| 55 | { |
| 56 | @@ -1621,6 +1643,9 @@ main (int argc, char *argv[]) |
| 57 | exit (1); |
| 58 | } |
| 59 | |
| 60 | + /* Make sure the file is valid. */ |
| 61 | + valid_file(fd); |
| 62 | + |
| 63 | dso = fdopen_dso (fd, file); |
| 64 | if (dso == NULL) |
| 65 | exit (1); |