Bug 13601 - Fail to load dynamic libs when entire ELF header cannot be read in one syscall
Summary: Fail to load dynamic libs when entire ELF header cannot be read in one syscall
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: dynamic-link (show other bugs)
Version: 2.14
: P2 normal
Target Milestone: ---
Assignee: Ulrich Drepper
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-01-18 04:14 UTC by Todd Tannenbaum
Modified: 2014-06-27 11:11 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Todd Tannenbaum 2012-01-18 04:14:38 UTC
As stated in the man pages, the read() system call may read/return less bytes than requested, for a variety of well-documented reasons.
In elf/dl-load.c, function open_verify() attempts to read the entire elf header (over 800 bytes on x86_84) in one invocation of the read system call, and if all bytes are not read, the shared library will not load with a "file too short" error. This could cause failures, for instance, loading over networked file systems configured with a small (less than 800byte) MTU size.

In elf/dl-load.c the problem is here:
1714:      size_t maplength;
1715:
1716:      /* We successfully openened the file.  Now verify it is a file
1717:	 we can use.  */
1718:      __set_errno (0);
1719:      fbp->len = __libc_read (fd, fbp->buf, sizeof (fbp->buf));
1720:
1721:      /* This is where the ELF header is loaded.  */
1722:      assert (sizeof (fbp->buf) > sizeof (ElfW(Ehdr)));
1723:      ehdr = (ElfW(Ehdr) *) fbp->buf;
1724:
1725:      /* Now run the tests.  */
1726:      if (__builtin_expect (fbp->len < (ssize_t) sizeof (ElfW(Ehdr)), 0))
1727:	{
1728:	  errval = errno;

On line 1719, if the read returns less than sizeof (ElfW(Ehdr)) as tested on line 1726, the library load will fail.

The call to libc_read on line 1719 should be repeated while libc_read
returns a value greater than zero.  If you desire me to write/submit a patch,
I'd be happy to help out, just ask.

Thank you!
Comment 1 Siddhesh Poyarekar 2012-10-20 03:30:25 UTC
Thanks, I have committed a fix:

http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=88481c163885767a6617823314802aa772271804