[PATCH] powerpc: Fix stack buffer overflow in _dl_reloc_overflwo (bug 34541)

[Dan Horák]

Hi Florian,

On Wed, 19 Aug 2026 11:29:58 +0200
Florian Weimer <fweimer@redhat.com> wrote:

> Consolidate the 32-bit and 64-bit implementation and use
> _dl_exception_create_format to create an exception message of the
> correct size.

there is a typo in the title/subject - _dl_reloc_overflwo should be
_dl_reloc_overflow


		Dan

> 
> ---
>  sysdeps/powerpc/Makefile               |  2 +-
>  sysdeps/powerpc/dl-reloc_overflow.c    | 48 ++++++++++++++++++++++++++++++++++
>  sysdeps/powerpc/powerpc32/dl-machine.c | 24 -----------------
>  sysdeps/powerpc/powerpc64/dl-machine.c | 27 -------------------
>  4 files changed, 49 insertions(+), 52 deletions(-)
> 
> diff --git a/sysdeps/powerpc/Makefile b/sysdeps/powerpc/Makefile
> index 5cdb64f29b..f3b6d5d725 100644
> --- a/sysdeps/powerpc/Makefile
> +++ b/sysdeps/powerpc/Makefile
> @@ -4,7 +4,7 @@ endif
>  
>  ifeq ($(subdir),elf)
>  # extra shared linker files to link into dl-allobjs.so and libc
> -sysdep-dl-routines += dl-machine hwcapinfo
> +sysdep-dl-routines += dl-machine dl-reloc_overflow hwcapinfo
>  sysdep_routines += dl-machine hwcapinfo
>  # extra shared linker files to link only into dl-allobjs.so
>  sysdep-rtld-routines += dl-machine hwcapinfo
> diff --git a/sysdeps/powerpc/dl-reloc_overflow.c b/sysdeps/powerpc/dl-reloc_overflow.c
> new file mode 100644
> index 0000000000..a8ebc0f7a2
> --- /dev/null
> +++ b/sysdeps/powerpc/dl-reloc_overflow.c
> @@ -0,0 +1,48 @@
> +/* Relocation overflow reporting for POWER.
> +   Copyright (C) 1995-2026 Free Software Foundation, Inc.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Library General Public License as
> +   published by the Free Software Foundation; either version 2 of the
> +   License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Library General Public License for more details.
> +
> +   You should have received a copy of the GNU Library General Public
> +   License along with the GNU C Library; see the file COPYING.LIB.  If
> +   not, see <https://www.gnu.org/licenses/>.  */
> +
> +#include <ldsodefs.h>
> +#include <dl-machine.h>
> +
> +void
> +_dl_reloc_overflow (struct link_map *map,
> +                    const char *name,
> +                    Elf64_Addr *const reloc_addr,
> +                    const Elf64_Sym *refsym)
> +{
> +  struct dl_exception exc;
> +
> +  char address[sizeof (void *) * 2 + 1];
> +  memset (address, '0', sizeof (address) - 1);
> +  address[sizeof (address) - 1] = '\0';
> +  _itoa_word ((unsigned long int) reloc_addr,
> +              &address[sizeof (address) -1], 16, 0);
> +
> +  const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
> +  if (refsym != NULL)
> +    _dl_exception_create_format
> +      (&exc, map->l_name,
> +       "%s reloc at 0x%s for symbol '%s' out of range",
> +       name, address, strtab + refsym->st_name);
> +  else
> +    _dl_exception_create_format
> +      (&exc, map->l_name,
> +       "%s reloc at 0x%s out of range", name, address);
> +
> +  _dl_signal_exception (0, &exc, NULL);
> +}
> diff --git a/sysdeps/powerpc/powerpc32/dl-machine.c b/sysdeps/powerpc/powerpc32/dl-machine.c
> index ebdfc63a47..bc538b7f4c 100644
> --- a/sysdeps/powerpc/powerpc32/dl-machine.c
> +++ b/sysdeps/powerpc/powerpc32/dl-machine.c
> @@ -377,30 +377,6 @@ __elf_machine_fixup_plt (struct link_map *map,
>    return finaladdr;
>  }
>  
> -void
> -_dl_reloc_overflow (struct link_map *map,
> -		    const char *name,
> -		    Elf32_Addr *const reloc_addr,
> -		    const Elf32_Sym *refsym)
> -{
> -  char buffer[128];
> -  char *t;
> -  t = stpcpy (buffer, name);
> -  t = stpcpy (t, " relocation at 0x00000000");
> -  _itoa_word ((unsigned) reloc_addr, t, 16, 0);
> -  if (refsym)
> -    {
> -      const char *strtab;
> -
> -      strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
> -      t = stpcpy (t, " for symbol `");
> -      t = stpcpy (t, strtab + refsym->st_name);
> -      t = stpcpy (t, "'");
> -    }
> -  t = stpcpy (t, " out of range");
> -  _dl_signal_error (0, map->l_name, NULL, buffer);
> -}
> -
>  void
>  __process_machine_rela (struct link_map *map,
>  			const Elf32_Rela *reloc,
> diff --git a/sysdeps/powerpc/powerpc64/dl-machine.c b/sysdeps/powerpc/powerpc64/dl-machine.c
> index 29fd15c8c7..37427b46b2 100644
> --- a/sysdeps/powerpc/powerpc64/dl-machine.c
> +++ b/sysdeps/powerpc/powerpc64/dl-machine.c
> @@ -22,33 +22,6 @@
>  #include <_itoa.h>
>  #include <dl-machine.h>
>  
> -void
> -_dl_reloc_overflow (struct link_map *map,
> -		    const char *name,
> -		    Elf64_Addr *const reloc_addr,
> -		    const Elf64_Sym *refsym)
> -{
> -  char buffer[1024];
> -  char *t;
> -  t = stpcpy (buffer, name);
> -  /* Notice that _itoa_word() writes characters from the higher address to the
> -     lower address, requiring the destination string to reserve all the
> -     required size before the call.  */
> -  t = stpcpy (t, " reloc at 0x0000000000000000");
> -  _itoa_word ((unsigned long) reloc_addr, t, 16, 0);
> -  if (refsym)
> -    {
> -      const char *strtab;
> -
> -      strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
> -      t = stpcpy (t, " for symbol `");
> -      t = stpcpy (t, strtab + refsym->st_name);
> -      t = stpcpy (t, "'");
> -    }
> -  t = stpcpy (t, " out of range");
> -  _dl_signal_error (0, map->l_name, NULL, buffer);
> -}
> -
>  #if _CALL_ELF == 2
>  void
>  _dl_error_localentry (struct link_map *map, const Elf64_Sym *refsym)
> 
> base-commit: a0faa928b094be829c52d1e493442ba3b48954b1
>