[PATCH] powerpc: Fix stack buffer overflow in _dl_reloc_overflwo (bug 34541)

[Florian Weimer]

Consolidate the 32-bit and 64-bit implementation and use
_dl_exception_create_format to create an exception message of the
correct size.

---
 sysdeps/powerpc/Makefile               |  2 +-
 sysdeps/powerpc/dl-reloc_overflow.c    | 48 ++++++++++++++++++++++++++++++++++
 sysdeps/powerpc/powerpc32/dl-machine.c | 24 -----------------
 sysdeps/powerpc/powerpc64/dl-machine.c | 27 -------------------
 4 files changed, 49 insertions(+), 52 deletions(-)

diff --git a/sysdeps/powerpc/Makefile b/sysdeps/powerpc/Makefile
index 5cdb64f29b..f3b6d5d725 100644
--- a/sysdeps/powerpc/Makefile
+++ b/sysdeps/powerpc/Makefile
@@ -4,7 +4,7 @@ endif
 
 ifeq ($(subdir),elf)
 # extra shared linker files to link into dl-allobjs.so and libc
-sysdep-dl-routines += dl-machine hwcapinfo
+sysdep-dl-routines += dl-machine dl-reloc_overflow hwcapinfo
 sysdep_routines += dl-machine hwcapinfo
 # extra shared linker files to link only into dl-allobjs.so
 sysdep-rtld-routines += dl-machine hwcapinfo
diff --git a/sysdeps/powerpc/dl-reloc_overflow.c b/sysdeps/powerpc/dl-reloc_overflow.c
new file mode 100644
index 0000000000..a8ebc0f7a2
--- /dev/null
+++ b/sysdeps/powerpc/dl-reloc_overflow.c
@@ -0,0 +1,48 @@
+/* Relocation overflow reporting for POWER.
+   Copyright (C) 1995-2026 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Library General Public License as
+   published by the Free Software Foundation; either version 2 of the
+   License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Library General Public License for more details.
+
+   You should have received a copy of the GNU Library General Public
+   License along with the GNU C Library; see the file COPYING.LIB.  If
+   not, see <https://www.gnu.org/licenses/>.  */
+
+#include <ldsodefs.h>
+#include <dl-machine.h>
+
+void
+_dl_reloc_overflow (struct link_map *map,
+                    const char *name,
+                    Elf64_Addr *const reloc_addr,
+                    const Elf64_Sym *refsym)
+{
+  struct dl_exception exc;
+
+  char address[sizeof (void *) * 2 + 1];
+  memset (address, '0', sizeof (address) - 1);
+  address[sizeof (address) - 1] = '\0';
+  _itoa_word ((unsigned long int) reloc_addr,
+              &address[sizeof (address) -1], 16, 0);
+
+  const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
+  if (refsym != NULL)
+    _dl_exception_create_format
+      (&exc, map->l_name,
+       "%s reloc at 0x%s for symbol '%s' out of range",
+       name, address, strtab + refsym->st_name);
+  else
+    _dl_exception_create_format
+      (&exc, map->l_name,
+       "%s reloc at 0x%s out of range", name, address);
+
+  _dl_signal_exception (0, &exc, NULL);
+}
diff --git a/sysdeps/powerpc/powerpc32/dl-machine.c b/sysdeps/powerpc/powerpc32/dl-machine.c
index ebdfc63a47..bc538b7f4c 100644
--- a/sysdeps/powerpc/powerpc32/dl-machine.c
+++ b/sysdeps/powerpc/powerpc32/dl-machine.c
@@ -377,30 +377,6 @@ __elf_machine_fixup_plt (struct link_map *map,
   return finaladdr;
 }
 
-void
-_dl_reloc_overflow (struct link_map *map,
-		    const char *name,
-		    Elf32_Addr *const reloc_addr,
-		    const Elf32_Sym *refsym)
-{
-  char buffer[128];
-  char *t;
-  t = stpcpy (buffer, name);
-  t = stpcpy (t, " relocation at 0x00000000");
-  _itoa_word ((unsigned) reloc_addr, t, 16, 0);
-  if (refsym)
-    {
-      const char *strtab;
-
-      strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
-      t = stpcpy (t, " for symbol `");
-      t = stpcpy (t, strtab + refsym->st_name);
-      t = stpcpy (t, "'");
-    }
-  t = stpcpy (t, " out of range");
-  _dl_signal_error (0, map->l_name, NULL, buffer);
-}
-
 void
 __process_machine_rela (struct link_map *map,
 			const Elf32_Rela *reloc,
diff --git a/sysdeps/powerpc/powerpc64/dl-machine.c b/sysdeps/powerpc/powerpc64/dl-machine.c
index 29fd15c8c7..37427b46b2 100644
--- a/sysdeps/powerpc/powerpc64/dl-machine.c
+++ b/sysdeps/powerpc/powerpc64/dl-machine.c
@@ -22,33 +22,6 @@
 #include <_itoa.h>
 #include <dl-machine.h>
 
-void
-_dl_reloc_overflow (struct link_map *map,
-		    const char *name,
-		    Elf64_Addr *const reloc_addr,
-		    const Elf64_Sym *refsym)
-{
-  char buffer[1024];
-  char *t;
-  t = stpcpy (buffer, name);
-  /* Notice that _itoa_word() writes characters from the higher address to the
-     lower address, requiring the destination string to reserve all the
-     required size before the call.  */
-  t = stpcpy (t, " reloc at 0x0000000000000000");
-  _itoa_word ((unsigned long) reloc_addr, t, 16, 0);
-  if (refsym)
-    {
-      const char *strtab;
-
-      strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
-      t = stpcpy (t, " for symbol `");
-      t = stpcpy (t, strtab + refsym->st_name);
-      t = stpcpy (t, "'");
-    }
-  t = stpcpy (t, " out of range");
-  _dl_signal_error (0, map->l_name, NULL, buffer);
-}
-
 #if _CALL_ELF == 2
 void
 _dl_error_localentry (struct link_map *map, const Elf64_Sym *refsym)

base-commit: a0faa928b094be829c52d1e493442ba3b48954b1