From patchwork Wed Mar 11 16:34:14 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aurelien Jarno X-Patchwork-Id: 449076 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id D5F761400B6 for ; Thu, 12 Mar 2015 03:34:27 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass reason="1024-bit key; unprotected key" header.d=sourceware.org header.i=@sourceware.org header.b=KuAXg705; dkim-adsp=none (unprotected policy); dkim-atps=neutral DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:date:from:to:subject:message-id:mime-version :content-type; q=dns; s=default; b=JOTn2HRvHVGMvKMpduOPa4ndktqG9 /dw+oIDs4E7lH+tgPMf0MUEWLkEqdm46CtIJvbDaImYvi2GolgK2wPbfIjwo1UvB EKuJQaWGNyAn8BG/VtxEeQhBq0g/lBWiCOYarHdJkIghbXVyWlCeFfIuN7PXnMyC ckHqediNvGFlnk= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:date:from:to:subject:message-id:mime-version :content-type; s=default; bh=xp0lb6cXry2n+8cpUFJe8RFWNGY=; b=KuA Xg705hLOKZJOvLCtZLCerypbbcknOq414Dv4+4bscgswpCuQPUycnKu/HPcr74oy +/YzrGgMVQxmJtJLstK0Fz4+zTwL5UamTTb5uUh4BAhEI1vXkZKQ9vRwDgj+/KgI L3RnI3ckOZ1kfgY3nh24OmkqQBHD7oDDz+xOntWE= Received: (qmail 77735 invoked by alias); 11 Mar 2015 16:34:20 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 77233 invoked by uid 89); 11 Mar 2015 16:34:19 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.9 required=5.0 tests=BAYES_00, T_RP_MATCHES_RCVD autolearn=ham version=3.3.2 X-HELO: hall.aurel32.net Date: Wed, 11 Mar 2015 17:34:14 +0100 From: Aurelien Jarno To: libc-alpha@sourceware.org Subject: [PATCH v2][BUG 18093] Fix ldconfig segmentation fault with corrupted cache Message-ID: <20150311163414.GB5438@aurel32.net> Mail-Followup-To: libc-alpha@sourceware.org MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) ldconfig is using an aux-cache to speed up the ld.so.cache update. It is read by mmaping the file to a structure which contains data offsets used as pointers. As they are not checked, it is not hard to get ldconfig to segfault with a corrupted file. This happens for instance if the file is truncated, which is common following a filesystem check following a system crash. This can be reproduced for example by truncating the file to roughly half of it's size. There is already some code in elf/cache.c (load_aux_cache) to check for a corrupted aux cache, but it happens to be broken and not enough. The test (aux_cache->nlibs >= aux_cache_size) compares the number of libs entry with the cache size. It's a non sense, as it basically assumes that each library entry is a 1 byte... Instead the patch below computes the theoretical cache size using the headers and compares it to the real size. 2015-03-11 Aurelien Jarno [BZ #18093] * elf/cache.c (load_aux_cache): Regenerate the cache if it has the wrong size. diff --git a/elf/cache.c b/elf/cache.c index 1732268..bde7984 100644 --- a/elf/cache.c +++ b/elf/cache.c @@ -698,7 +698,9 @@ load_aux_cache (const char *aux_cache_name) if (aux_cache == MAP_FAILED || aux_cache_size < sizeof (struct aux_cache_file) || memcmp (aux_cache->magic, AUX_CACHEMAGIC, sizeof AUX_CACHEMAGIC - 1) - || aux_cache->nlibs >= aux_cache_size) + || aux_cache_size != (sizeof(struct aux_cache_file) + + aux_cache->nlibs * sizeof(struct aux_cache_file_entry) + + aux_cache->len_strings)) { close (fd); init_aux_cache ();