[Bug dynamic-link/23187] New: DSO with many Phdr[]s causes stack overflow in dl-load.c / open_verify and _dl_map_object_from_fd

[ppluzhnikov at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=23187

            Bug ID: 23187
           Summary: DSO with many Phdr[]s causes stack overflow in
                    dl-load.c / open_verify and _dl_map_object_from_fd
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: ppluzhnikov at google dot com
  Target Milestone: ---

In open_verify:

  maplength = ehdr->e_phnum * sizeof (ElfW(Phdr));
  ...
     phdr = alloca (maplength);

In _dl_map_object_from_fd:

  struct loadcmd loadcmds[l->l_phnum];

Both of these are problematic: a specially-crafted DSO can have up to 65535
Phdr[]s, resulting in stack overflow attempting to dlopen or run ldd or "ld.so
--list" on such a DSO, when stack limit is below 6MiB.

-- 
You are receiving this mail because:
You are on the CC list for the bug.