Re: 回复: Re: [PATCH] elf: Limit program header count to 64 [BZ #21265]

[Carlos O'Donell]

On 2/13/26 4:41 AM, Florian Weimer wrote:
> * 李腾龙:
> 
>> **Refactoring to iteration** (Florian's suggestion):
>> I agree this is the ideal long-term solution. However, it requires significant
>> changes to _dl_map_segments and careful testing. For addressing the immediate
>> security issue (CVE-2017-1000366), the bounded approach provides a simpler,
>> lower-risk fix that can be backported easily.
> 
> There is no security vulnerability here because program headers are
> trusted, and glibc should be compiled with -fstack-clash-protection
> (targets without proper compiler support for -fstack-clash-protection
> are best avoided).  That's why I think we don't need to add an
> artificial limit as a stop-gap measure.

Agreed.

There is perhaps a discussion here about being able to limit the maximum
number of PT_LOAD segments for other reasons e.g. audit.

Do we expose this via la_activity() to be able to audit an object before
we attempt to load it? Say if a user wanted to limit the loading of such
objects?

-- 
Cheers,
Carlos.