[PATCH] BZ #15754: CVE-2013-4788 (v3)

[Carlos O'Donell]

On 09/23/2013 12:49 AM, Carlos O'Donell wrote:
> I would appreciate it if machine maintainers ran the testsuite
> and tweaked the offsets appropriately if they are not correct.

One problem I didn't notice.

> diff --git a/sysdeps/generic/stackguard-macros.h b/sysdeps/generic/stackguard-macros.h
> index ababf65..77408c6 100644
> --- a/sysdeps/generic/stackguard-macros.h
> +++ b/sysdeps/generic/stackguard-macros.h
> @@ -2,3 +2,6 @@
>  
>  extern uintptr_t __stack_chk_guard;
>  #define STACK_CHK_GUARD __stack_chk_guard
> +
> +extern uintptr_t __pointer_chk_guard_local;
> +#define POINTER_CHK_GUARD __pointer_chk_guard_local

I failed to notice the non-static regression for
tst-ptrguard1.

On ARM it's __pointer_chk_guard in the dynamic case, and 
__pointer_chk_guard_local in the static case. This is done
on purpose, I guess we could change the name of the variable
in csu/libc-start.c, but I think it's useful to have it remain
*_local to mirror the similar internal name in elf/rtld.c.

I've applied this fix. Both the dynamic and static tests pass now.
There should be no regressions.

2013-09-23  Carlos O'Donell  <carlos@redhat.com>
 
	[BZ #15754]
	* sysdeps/generic/stackguard-macros.h: If PTRGUARD_LOCAL use
	__pointer_chk_guard_local, otherwise __pointer_chk_guard.
	* elf/Makefile: Define CFLAGS-tst-ptrguard1-static.c.

diff --git a/elf/Makefile b/elf/Makefile
index cb8da93..27d249b 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -1019,6 +1019,9 @@ tst-stackguard1-ARGS = --command "$(host-test-program-cmd) --child"
 tst-stackguard1-static-ARGS = --command "$(objpfx)tst-stackguard1-static --child"
 
 tst-ptrguard1-ARGS = --command "$(host-test-program-cmd) --child"
+# When built statically, the pointer guard interface uses
+# __pointer_chk_guard_local.
+CFLAGS-tst-ptrguard1-static.c = -DPTRGUARD_LOCAL
 tst-ptrguard1-static-ARGS = --command "$(objpfx)tst-ptrguard1-static --child"
 
 $(objpfx)tst-leaks1: $(libdl)
diff --git a/sysdeps/generic/stackguard-macros.h b/sysdeps/generic/stackguard-macros.h
index 4fa3d96..b4a6b23 100644
--- a/sysdeps/generic/stackguard-macros.h
+++ b/sysdeps/generic/stackguard-macros.h
@@ -3,5 +3,10 @@
 extern uintptr_t __stack_chk_guard;
 #define STACK_CHK_GUARD __stack_chk_guard
 
+#ifdef PTRGUARD_LOCAL
 extern uintptr_t __pointer_chk_guard_local;
-#define POINTER_CHK_GUARD __pointer_chk_guard_local
+# define POINTER_CHK_GUARD __pointer_chk_guard_local
+#else
+extern uintptr_t __pointer_chk_guard;
+# define POINTER_CHK_GUARD __pointer_chk_guard
+#endif
---

Cheers,
Carlos.