Page MenuHomeFreeBSD
Differential D58541

rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz
ClosedPublic
Actions

Authored by jhb on Wed, Jul 29, 7:23 PM.
Tags
None
Referenced Files
F168232363: D58541.diff
Thu, Aug 27, 2:07 AM
F168231897: D58541.diff
Thu, Aug 27, 2:03 AM
F168210719: D58541.diff
Wed, Aug 26, 10:14 PM
Unknown Object (File)
Wed, Aug 26, 12:08 AM
Unknown Object (File)
Tue, Aug 25, 9:58 PM
Unknown Object (File)
Tue, Aug 25, 8:09 PM
Unknown Object (File)
Tue, Aug 25, 5:26 PM
Unknown Object (File)
Sun, Aug 23, 7:58 PM
View All 39 Files
Subscribers
bdragon
imp

Details

Reviewers
kib
markj
jrtc27
Commits
rG535eb24d8451: rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz
Summary

All sorts of places in the ELF loading code assume that filesz <=
memsz, so check that explicitly up front. The kernel already performs
this check for the PT_LOAD segments in the main binary and rtld in
imgact_elf.c.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 75276
Build 72159: arc lint + arc unit

Event Timeline

jhb created this revision.Wed, Jul 29, 7:23 PM
Herald added subscribers: bdragon, imp. · View Herald TranscriptWed, Jul 29, 7:23 PM
jhb requested review of this revision.Wed, Jul 29, 7:23 PM
Harbormaster completed remote builds in B75276: Diff 183070.Wed, Jul 29, 7:23 PM
jhb added a parent revision: D58540: stand: Improve error handling when loading ELF files.Wed, Jul 29, 7:23 PM
jhb added a child revision: D58542: kld: Reject kernel modules with PT_LOAD segments where filesz > memsz.
kib accepted this revision.Thu, Jul 30, 4:24 AM

I do not object, but I also note that rtld trusts the format of the objects to be correct. There is a lot of missed bounds checks.

This revision is now accepted and ready to land.Thu, Jul 30, 4:24 AM
jrtc27 accepted this revision.Thu, Jul 30, 10:00 AM

There's also lib/libc/gen/tls.c for PT_TLS

jhb added a comment.Thu, Jul 30, 12:36 PM
In D58541#1343668, @jrtc27 wrote:

There's also lib/libc/gen/tls.c for PT_TLS

Oof, thanks for catching that, I'll add another commit for that.

Closed by commit rG535eb24d8451: rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz (authored by jhb). · Explain WhyFri, Jul 31, 5:58 PM
This revision was automatically updated to reflect the committed changes.
jhb added a commit: rG535eb24d8451: rtld: Reject ELF files with PT_LOAD or PT_TLS segments where filesz > memsz.

Revision Contents
Changeset List

PathSize
libexec/
rtld-elf/
12 lines
6 lines

Diff 183070

View Options

libexec/rtld-elf/map_object.c

Loading...
View Options

libexec/rtld-elf/rtld.c

Loading...