回复: Re: [PATCH] elf: Limit program header count to 64 [BZ #21265]

[Florian Weimer]

* 李腾龙:

> **Refactoring to iteration** (Florian's suggestion):
> I agree this is the ideal long-term solution. However, it requires significant
> changes to _dl_map_segments and careful testing. For addressing the immediate
> security issue (CVE-2017-1000366), the bounded approach provides a simpler,
> lower-risk fix that can be backported easily.

There is no security vulnerability here because program headers are
trusted, and glibc should be compiled with -fstack-clash-protection
(targets without proper compiler support for -fstack-clash-protection
are best avoided).  That's why I think we don't need to add an
artificial limit as a stop-gap measure.

Thanks,
Florian