[PATCH v1] libio: validate and mangle the wide vtable

[Florian Weimer]

* Alessandro Schino:

> Calls dispatched through _IO_wide_data._wide_vtable (the WJUMP* macros)
> were not validated, unlike the narrow vtable which goes through
> IO_validate_vtable.  This asymmetry is the primitive used by the FSOP
> family known publicly as "House of Apple 2" / angry-FSROP: point the
> checked narrow vtable at _IO_wfile_jumps to pass the existing check,
> then hide a forged function pointer in the unchecked wide vtable,
> reached via _IO_wfile_overflow -> _IO_wdoallocbuf -> _IO_WDOALLOCATE.

I think you can just store the vtable array index there and perform a
bounds check as the validation.  There is no need to preserve any form
of ABI compatibility.

Thanks,
Florian