Page MenuHomeFreeBSD

rtld: Fix segfault in direct exec mode
ClosedPublic

Authored by rstone on Jan 2 2020, 4:08 PM.

Details

Summary

When rtld is directly executed with arguments, it has to move the
program arguments, environment and elf aux data up a few slots to
remove its own arguments before the process being executed sees
them. When copying the environment, rtld was incorrectly testing
whether the location about to be written to currently contained
NULL, when was supposed to check whether it had just copied the
NULL terminator of the environment string. This had the result
that the ELF aux data was mostly treated as environment variables,
and rtld would quickly crash when it tried to access required
ELF aux data that it didn't think was present.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

rstone created this revision.Jan 2 2020, 4:08 PM
kib accepted this revision.Jan 2 2020, 5:32 PM
This revision is now accepted and ready to land.Jan 2 2020, 5:32 PM
This revision was automatically updated to reflect the committed changes.