Bug 15465 - LD_DEBUG=symbols crashes when program name is not available
Summary: LD_DEBUG=symbols crashes when program name is not available
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: dynamic-link (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Siddhesh Poyarekar
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-05-14 09:52 UTC by Siddhesh Poyarekar
Modified: 2014-06-13 17:49 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Siddhesh Poyarekar 2013-05-14 09:52:46 UTC
Running a program with LD_DEBUG=symbols defined may crash if the program tampers with argc and argv.

Steps to Reproduce:

foo.c:

#include <stdio.h>
#include <string.h>

int
main (int argc, char **argv)
{
  argv[0] = argv[1];
  argc--;

  foo ();
}

foo-lib.c:

void
foo (void)
{
  return; 
}

cc -o foo-lib.so -shared -fPIC foo-lib.c
cc -o foo foo.c ./foo-lib.so
LD_DEBUG=symbols ./foo

Actual Results:

Segfault

Expected Results:

No segfault.
Comment 1 Siddhesh Poyarekar 2013-05-29 16:06:37 UTC
Fixed in master:

commit b937534868c8d7aec3b6d645bf5fd657bbfccd42
Author: Siddhesh Poyarekar <siddhesh@redhat.com>
Date:   Wed May 29 21:30:20 2013 +0530

    Avoid crashing in LD_DEBUG when program name is unavailable
    
    Resolves: #15465
    
    The program name may be unavailable if the user application tampers
    with argc and argv[].  Some parts of the dynamic linker caters for
    this while others don't, so this patch consolidates the check and
    fallback into a single macro and updates all users.