Print this page
5547 libproc's fake_elf should give up if there's no .hash
5546 libproc's fake_elf may free stack junk when reading corrupt dumps

Split Close
Expand all
Collapse all
          --- old/usr/src/lib/libproc/common/Psymtab_machelf32.c
          +++ new/usr/src/lib/libproc/common/Psymtab_machelf32.c
↓ open down ↓ 241 lines elided ↑ open up ↑
 242  242          const int di_req_mask = (1 << DI_SYMTAB) | (1 << DI_HASH) |
 243  243                  (1 << DI_SYMENT) | (1 << DI_STRTAB) | (1 << DI_STRSZ);
 244  244          int di_mask = 0;
 245  245          size_t size = 0;
 246  246          caddr_t elfdata = NULL;
 247  247          Elf *elf;
 248  248          size_t dynsym_size = 0, ldynsym_size;
 249  249          int dynstr_shndx;
 250  250          Ehdr *ep;
 251  251          Shdr *sp;
 252      -        Dyn *dp;
      252 +        Dyn *dp = NULL;
 253  253          Dyn *d[DI_NENT] = { 0 };
 254  254          uint_t i;
 255  255          Off off;
 256  256          size_t pltsz = 0, pltentries = 0;
 257  257          uintptr_t hptr = NULL;
 258  258          Word hnchains, hnbuckets;
 259  259  
 260  260          if (ehdr->e_type == ET_DYN)
 261  261                  phdr->p_vaddr += addr;
 262  262  
↓ open down ↓ 96 lines elided ↑ open up ↑
 359  359                  if (Pread(P, hash, sizeof (hash), hptr) != sizeof (hash)) {
 360  360                          dprintf("Pread of .hash at %lx failed\n",
 361  361                              (long)(hptr));
 362  362                          goto bad;
 363  363                  }
 364  364  
 365  365                  hnbuckets = hash[0];
 366  366                  hnchains = hash[1];
 367  367          }
 368  368  
      369 +        if ((d[DI_HASH] == NULL) || (hnbuckets == 0) || (hnchains == 0)) {
      370 +                dprintf("empty or missing .hash\n");
      371 +                goto bad;
      372 +        }
      373 +
 369  374          /*
 370  375           * .dynsym and .SUNW_ldynsym sections.
 371  376           *
 372  377           * The string table section used for the symbol table and
 373  378           * dynamic sections lies immediately after the dynsym, so the
 374  379           * presence of SUNW_ldynsym changes the dynstr section index.
 375  380           */
 376  381          if (d[DI_SUNW_SYMTAB] != NULL) {
 377  382                  size += sizeof (Shdr);  /* SUNW_ldynsym shdr */
 378  383                  ldynsym_size = (size_t)d[DI_SUNW_SYMSZ]->d_un.d_val;
↓ open down ↓ 344 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX