[PATCH v2] libio: validate the wide vtable via a bounds-checked index
Alessandro Schino
7991aleschino@gmail.com
Mon Aug 24 16:56:05 GMT 2026
Calls dispatched through _IO_wide_data._wide_vtable (the WJUMP* macros)
were not validated, unlike the narrow vtable which goes through
IO_validate_vtable. This asymmetry is the primitive used by the FSOP
family known publicly as "House of Apple 2" / angry-FSROP: point the
checked narrow vtable at _IO_wfile_jumps to pass the existing check,
then hide a forged function pointer in the unchecked wide vtable,
reached via _IO_wfile_overflow -> _IO_wdoallocbuf -> _IO_WDOALLOCATE.
Following Florian Weimer's suggestion, store the index of the wide jump
table into __io_vtables rather than a raw pointer, and bounds-check the
index on use. The field is internal, so there is no ABI compatibility
concern. An attacker who overwrites _wide_vtable_index can only select
a value that is either in range (a legitimate table) or out of range
(rejected by WIO_validate_index). This is simpler than pointer
mangling: no pointer guard dependency, and the standard streams can be
statically initialized with the constant index IO_WFILE_JUMPS, so no
startup fix-up is needed.
The two spots that copy the wide vtable into the narrow vtable slot
resolve and bounds-check the index first.
Add tst-wide-vtable-check to verify that an out-of-range wide vtable
index aborts the process and that legitimate wide I/O is unaffected.
Signed-off-by: Alessandro Schino <7991aleschino@gmail.com>
---
Changes in v2 (following Florian Weimer's review):
- Store the __io_vtables index instead of a mangled pointer, and
bounds-check it on dispatch (WIO_validate_index).
- Rename the _IO_wide_data field to _wide_vtable_index (unsigned int).
It is internal, so there is no ABI concern.
- Drop pointer mangling entirely: no pointer-guard dependency and no
startup fix-up. The standard streams are statically initialized
with the constant index IO_WFILE_JUMPS.
- elf/libc_early_init.c no longer needs any change.
libio/Makefile | 2 +-
libio/fileops.c | 12 ++--
libio/freopen.c | 2 +-
libio/freopen64.c | 2 +-
libio/genops.c | 2 +-
libio/iofopen.c | 2 +-
libio/iofwide.c | 2 +-
libio/libio.h | 9 ++-
libio/libioP.h | 48 +++++++++++++-
libio/stdfiles.c | 4 +-
libio/tst-wide-vtable-check.c | 117 ++++++++++++++++++++++++++++++++++
11 files changed, 184 insertions(+), 18 deletions(-)
create mode 100644 libio/tst-wide-vtable-check.c
diff --git a/libio/Makefile b/libio/Makefile
index 616107ee10..c2ed504586 100644
--- a/libio/Makefile
+++ b/libio/Makefile
@@ -169,7 +169,7 @@ $(objpfx)tst-popen-fork: $(shared-thread-library)
$(objpfx)tst-file-init-race: $(shared-thread-library)
-tests-internal = tst-vtables tst-vtables-interposed
+tests-internal = tst-vtables tst-vtables-interposed tst-wide-vtable-check
ifeq (yes,$(build-shared))
# Add test-fopenloc only if shared library is enabled since it depends on
diff --git a/libio/fileops.c b/libio/fileops.c
index 9348d7c3a1..7387449381 100644
--- a/libio/fileops.c
+++ b/libio/fileops.c
@@ -396,7 +396,7 @@ _IO_new_file_fopen (FILE *fp, const char *filename, const char *mode,
cc->__cd_out.step_data.__statep = &result->_wide_data->_IO_state;
/* From now on use the wide character callback functions. */
- _IO_JUMPS_FILE_plus (fp) = fp->_wide_data->_wide_vtable;
+ _IO_JUMPS_FILE_plus (fp) = WIO_validate_index (fp->_wide_data->_wide_vtable_index);
/* Set the mode now. */
result->_mode = 1;
@@ -449,7 +449,7 @@ _IO_file_setbuf_mmap (FILE *fp, char *p, ssize_t len)
/* Change the function table. */
_IO_JUMPS_FILE_plus (fp) = &_IO_file_jumps;
- fp->_wide_data->_wide_vtable = &_IO_wfile_jumps;
+ _IO_WIDE_JUMPS_FUNC_UPDATE (fp, &_IO_wfile_jumps);
/* And perform the normal operation. */
result = _IO_new_file_setbuf (fp, p, len);
@@ -458,7 +458,7 @@ _IO_file_setbuf_mmap (FILE *fp, char *p, ssize_t len)
if (result == NULL)
{
_IO_JUMPS_FILE_plus (fp) = &_IO_file_jumps_mmap;
- fp->_wide_data->_wide_vtable = &_IO_wfile_jumps_mmap;
+ _IO_WIDE_JUMPS_FUNC_UPDATE (fp, &_IO_wfile_jumps_mmap);
}
return result;
@@ -681,7 +681,7 @@ mmap_remap_check (FILE *fp)
_IO_JUMPS_FILE_plus (fp) = &_IO_file_jumps;
else
_IO_JUMPS_FILE_plus (fp) = &_IO_wfile_jumps;
- fp->_wide_data->_wide_vtable = &_IO_wfile_jumps;
+ _IO_WIDE_JUMPS_FUNC_UPDATE (fp, &_IO_wfile_jumps);
return 1;
}
@@ -751,7 +751,7 @@ decide_maybe_mmap (FILE *fp)
_IO_JUMPS_FILE_plus (fp) = &_IO_file_jumps_mmap;
else
_IO_JUMPS_FILE_plus (fp) = &_IO_wfile_jumps_mmap;
- fp->_wide_data->_wide_vtable = &_IO_wfile_jumps_mmap;
+ _IO_WIDE_JUMPS_FUNC_UPDATE (fp, &_IO_wfile_jumps_mmap);
return;
}
@@ -764,7 +764,7 @@ decide_maybe_mmap (FILE *fp)
_IO_JUMPS_FILE_plus (fp) = &_IO_file_jumps;
else
_IO_JUMPS_FILE_plus (fp) = &_IO_wfile_jumps;
- fp->_wide_data->_wide_vtable = &_IO_wfile_jumps;
+ _IO_WIDE_JUMPS_FUNC_UPDATE (fp, &_IO_wfile_jumps);
}
int
diff --git a/libio/freopen.c b/libio/freopen.c
index c3047facd4..c851dc430b 100644
--- a/libio/freopen.c
+++ b/libio/freopen.c
@@ -78,7 +78,7 @@ freopen (const char *filename, const char *mode, FILE *fp)
_IO_file_close_maybe_unlink (fp, false);
_IO_JUMPS_FILE_plus (fp) = &_IO_file_jumps;
if (_IO_vtable_offset (fp) == 0 && fp->_wide_data != NULL)
- fp->_wide_data->_wide_vtable = &_IO_wfile_jumps;
+ _IO_WIDE_JUMPS_FUNC_UPDATE (fp, &_IO_wfile_jumps);
fp->_flags2 &= ~(_IO_FLAGS2_MMAP
| _IO_FLAGS2_NOTCANCEL
| _IO_FLAGS2_CLOEXEC);
diff --git a/libio/freopen64.c b/libio/freopen64.c
index c499a8375c..8613dc0f05 100644
--- a/libio/freopen64.c
+++ b/libio/freopen64.c
@@ -58,7 +58,7 @@ freopen64 (const char *filename, const char *mode, FILE *fp)
_IO_file_close_maybe_unlink (fp, false);
_IO_JUMPS_FILE_plus (fp) = &_IO_file_jumps;
if (_IO_vtable_offset (fp) == 0 && fp->_wide_data != NULL)
- fp->_wide_data->_wide_vtable = &_IO_wfile_jumps;
+ _IO_WIDE_JUMPS_FUNC_UPDATE (fp, &_IO_wfile_jumps);
fp->_flags2 &= ~(_IO_FLAGS2_MMAP
| _IO_FLAGS2_NOTCANCEL
| _IO_FLAGS2_CLOEXEC);
diff --git a/libio/genops.c b/libio/genops.c
index 90e08e6571..1021032d44 100644
--- a/libio/genops.c
+++ b/libio/genops.c
@@ -604,7 +604,7 @@ _IO_no_init (FILE *fp, int flags, int orientation,
fp->_wide_data->_IO_backup_base = NULL;
fp->_wide_data->_IO_save_end = NULL;
- fp->_wide_data->_wide_vtable = jmp;
+ _IO_WIDE_JUMPS_FUNC_UPDATE (fp, jmp);
}
else
/* Cause predictable crash when a wide function is called on a byte
diff --git a/libio/iofopen.c b/libio/iofopen.c
index 516aee70bd..7ac65872b1 100644
--- a/libio/iofopen.c
+++ b/libio/iofopen.c
@@ -45,7 +45,7 @@ __fopen_maybe_mmap (FILE *fp)
_IO_JUMPS_FILE_plus (fp) = &_IO_file_jumps_maybe_mmap;
else
_IO_JUMPS_FILE_plus (fp) = &_IO_wfile_jumps_maybe_mmap;
- fp->_wide_data->_wide_vtable = &_IO_wfile_jumps_maybe_mmap;
+ _IO_WIDE_JUMPS_FUNC_UPDATE (fp, &_IO_wfile_jumps_maybe_mmap);
}
#endif
return fp;
diff --git a/libio/iofwide.c b/libio/iofwide.c
index d016aa33ea..759fe94ac3 100644
--- a/libio/iofwide.c
+++ b/libio/iofwide.c
@@ -96,7 +96,7 @@ _IO_fwide (FILE *fp, int mode)
}
/* From now on use the wide character callback functions. */
- _IO_JUMPS_FILE_plus (fp) = fp->_wide_data->_wide_vtable;
+ _IO_JUMPS_FILE_plus (fp) = WIO_validate_index (fp->_wide_data->_wide_vtable_index);
}
/* Set the mode now. */
diff --git a/libio/libio.h b/libio/libio.h
index 6cbaf29f19..87d0b6cc1c 100644
--- a/libio/libio.h
+++ b/libio/libio.h
@@ -145,7 +145,14 @@ struct _IO_wide_data
wchar_t _shortbuf[1];
- const struct _IO_jump_t *_wide_vtable;
+ /* Index into __io_vtables identifying the wide jump table, instead of
+ a raw pointer. Storing an index and bounds-checking it on use (see
+ _IO_WIDE_JUMPS_FUNC in libioP.h) prevents an attacker who can
+ overwrite this field from redirecting wide I/O to an arbitrary
+ address (the "House of Apple 2" / FSROP primitive), since the wide
+ vtable dispatch was previously unchecked. This field is internal
+ and not part of the ABI. */
+ unsigned int _wide_vtable_index;
};
struct _IO_FILE_plus;
diff --git a/libio/libioP.h b/libio/libioP.h
index 78e8ee6835..a189fef270 100644
--- a/libio/libioP.h
+++ b/libio/libioP.h
@@ -100,8 +100,9 @@
#define _IO_JUMPS(THIS) (THIS)->vtable
#define _IO_JUMPS_FILE_plus(THIS) \
_IO_CAST_FIELD_ACCESS ((THIS), struct _IO_FILE_plus, vtable)
-#define _IO_WIDE_JUMPS(THIS) \
- _IO_CAST_FIELD_ACCESS ((THIS), struct _IO_FILE, _wide_data)->_wide_vtable
+/* Raw accessor for the stored wide vtable index. */
+#define _IO_WIDE_JUMPS_INDEX(THIS) \
+ (_IO_CAST_FIELD_ACCESS ((THIS), struct _IO_FILE, _wide_data)->_wide_vtable_index)
#define _IO_CHECK_WIDE(THIS) \
(_IO_CAST_FIELD_ACCESS ((THIS), struct _IO_FILE, _wide_data) != NULL)
@@ -120,7 +121,13 @@
(_IO_JUMPS_FILE_plus (THIS) = (VTABLE))
# define _IO_vtable_offset(THIS) 0
#endif
-#define _IO_WIDE_JUMPS_FUNC(THIS) _IO_WIDE_JUMPS(THIS)
+/* Look up the wide vtable by its stored index, bounds-checked. */
+#define _IO_WIDE_JUMPS_FUNC(THIS) \
+ (WIO_validate_index (_IO_WIDE_JUMPS_INDEX (THIS)))
+/* Store the index of VTABLE (a pointer into __io_vtables) into the wide
+ vtable slot. Replaces every direct "_wide_vtable = ..." assignment. */
+#define _IO_WIDE_JUMPS_FUNC_UPDATE(THIS, VTABLE) \
+ (_IO_WIDE_JUMPS_INDEX (THIS) = WIO_vtable_to_index (VTABLE))
#define JUMP_FIELD(TYPE, NAME) TYPE NAME
#define JUMP0(FUNC, THIS) (_IO_JUMPS_FUNC(THIS)->FUNC) (THIS)
#define JUMP1(FUNC, THIS, X1) (_IO_JUMPS_FUNC(THIS)->FUNC) (THIS, X1)
@@ -1050,6 +1057,41 @@ IO_validate_vtable (const struct _IO_jump_t *vtable)
return vtable;
}
+#if IS_IN (libc)
+/* Wide vtable hardening.
+
+ The wide jump table reached through the WJUMP* macros is identified by
+ an index into __io_vtables (stored in _IO_wide_data._wide_vtable_index)
+ rather than by a raw pointer. On use the index is bounds-checked and
+ resolved to &__io_vtables[index]. An attacker who overwrites the field
+ can only select a value that is either in range (a legitimate table) or
+ out of range (rejected). This closes the House of Apple 2 / FSROP
+ primitive, where the wide vtable dispatch was previously unchecked. */
+
+/* Resolve a stored wide vtable index to its jump table, bounds-checked. */
+static inline const struct _IO_jump_t *
+WIO_validate_index (unsigned int index)
+{
+ if (__glibc_unlikely (index >= IO_VTABLES_NUM))
+ _IO_vtable_check ();
+ return &__io_vtables[index];
+}
+
+/* Convert a wide vtable pointer (which must point at the start of a table
+ inside __io_vtables) to its index for storage. */
+static inline unsigned int
+WIO_vtable_to_index (const struct _IO_jump_t *vtable)
+{
+ uintptr_t offset = (uintptr_t) vtable - (uintptr_t) &__io_vtables;
+ /* The pointer must be aligned to the start of a jump table and lie
+ within the section; otherwise the stored index would be bogus. */
+ if (__glibc_unlikely (offset >= IO_VTABLES_LEN
+ || offset % sizeof (struct _IO_jump_t) != 0))
+ _IO_vtable_check ();
+ return offset / sizeof (struct _IO_jump_t);
+}
+#endif /* IS_IN (libc) */
+
/* In case of an allocation failure, we resort to using the fixed buffer
_SHORT_BACKUPBUF. Free PTR unless it points to that buffer. */
static __always_inline void
diff --git a/libio/stdfiles.c b/libio/stdfiles.c
index 734865dd71..272efb187e 100644
--- a/libio/stdfiles.c
+++ b/libio/stdfiles.c
@@ -36,14 +36,14 @@
# define DEF_STDFILE(NAME, FD, CHAIN, FLAGS) \
static _IO_lock_t _IO_stdfile_##FD##_lock = _IO_lock_initializer; \
static struct _IO_wide_data _IO_wide_data_##FD \
- = { ._wide_vtable = &_IO_wfile_jumps }; \
+ = { ._wide_vtable_index = IO_WFILE_JUMPS }; \
struct _IO_FILE_plus NAME \
= {FILEBUF_LITERAL(CHAIN, FLAGS, FD, &_IO_wide_data_##FD), \
&_IO_file_jumps};
#else
# define DEF_STDFILE(NAME, FD, CHAIN, FLAGS) \
static struct _IO_wide_data _IO_wide_data_##FD \
- = { ._wide_vtable = &_IO_wfile_jumps }; \
+ = { ._wide_vtable_index = IO_WFILE_JUMPS }; \
struct _IO_FILE_plus NAME \
= {FILEBUF_LITERAL(CHAIN, FLAGS, FD, &_IO_wide_data_##FD), \
&_IO_file_jumps};
diff --git a/libio/tst-wide-vtable-check.c b/libio/tst-wide-vtable-check.c
new file mode 100644
index 0000000000..ebee302a96
--- /dev/null
+++ b/libio/tst-wide-vtable-check.c
@@ -0,0 +1,117 @@
+/* Test that a corrupted wide vtable index (_IO_wide_data._wide_vtable_index)
+ is detected and the process is terminated. This exercises the hardening
+ that closes the House of Apple 2 / FSROP primitive, where the wide vtable
+ dispatch was previously unchecked.
+ Copyright (C) 2026 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <https://www.gnu.org/licenses/>. */
+
+#include <stdio.h>
+#include <wchar.h>
+#include <string.h>
+#include <signal.h>
+
+#include <libioP.h>
+#include <support/capture_subprocess.h>
+#include <support/check.h>
+#include <support/support.h>
+
+/* The fatal message printed by _IO_vtable_check on detection. */
+static const char expected_message[]
+ = "Fatal error: glibc detected an invalid stdio handle\n";
+
+/* Open a wide-oriented stream backed by a temporary file and return it.
+ The stream is oriented wide so that subsequent wide operations follow
+ the wide vtable dispatch path. */
+static FILE *
+open_wide_stream (void)
+{
+ FILE *fp = tmpfile ();
+ TEST_VERIFY_EXIT (fp != NULL);
+ /* Orient the stream towards wide characters. */
+ TEST_VERIFY_EXIT (fwide (fp, 1) > 0);
+ return fp;
+}
+
+/* Callback: overwrite the wide vtable index with an out-of-range value
+ (as an attacker who can write the field would) and trigger a wide
+ operation. The bounds check in WIO_validate_index rejects it and the
+ dispatch aborts. */
+static void
+corrupt_out_of_range (void *closure)
+{
+ FILE *fp = open_wide_stream ();
+ fp->_wide_data->_wide_vtable_index = IO_VTABLES_NUM + 100;
+ /* Force buffer allocation, which dispatches through the wide vtable
+ (_IO_WDOALLOCATE and friends). */
+ fputwc (L'x', fp);
+ /* Should not be reached. */
+ fclose (fp);
+}
+
+/* Callback: a large index, as would result from an attacker overwriting
+ the field with a pointer-sized garbage value truncated into the
+ index. Also out of range, so rejected. */
+static void
+corrupt_huge_index (void *closure)
+{
+ FILE *fp = open_wide_stream ();
+ fp->_wide_data->_wide_vtable_index = 0x41414141;
+ fputwc (L'y', fp);
+ fclose (fp);
+}
+
+/* Run CALLBACK in a subprocess and require that it terminates with
+ SIGABRT and prints the fatal stdio message. */
+static void
+expect_termination (const char *name, void (*callback) (void *))
+{
+ struct support_capture_subprocess proc
+ = support_capture_subprocess (callback, NULL);
+ support_capture_subprocess_check (&proc, name, -SIGABRT, sc_allow_stderr);
+ TEST_COMPARE_BLOB (proc.err.buffer, proc.err.length,
+ expected_message, strlen (expected_message));
+ support_capture_subprocess_free (&proc);
+}
+
+/* Sanity check: an untampered wide stream works and does not abort. */
+static void
+legitimate_stream (void *closure)
+{
+ FILE *fp = open_wide_stream ();
+ TEST_VERIFY (fputwc (L'z', fp) == L'z');
+ TEST_VERIFY (fclose (fp) == 0);
+}
+
+static int
+do_test (void)
+{
+ /* The legitimate case must run to completion (exit status 0). */
+ {
+ struct support_capture_subprocess proc
+ = support_capture_subprocess (legitimate_stream, NULL);
+ support_capture_subprocess_check (&proc, "legitimate", 0, sc_allow_stderr);
+ support_capture_subprocess_free (&proc);
+ }
+
+ /* Corruptions must be detected and abort the process. */
+ expect_termination ("out-of-range", corrupt_out_of_range);
+ expect_termination ("huge-index", corrupt_huge_index);
+
+ return 0;
+}
+
+#include <support/test-driver.c>
--
2.55.0
More information about the Libc-alpha
mailing list