1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
From e11815bb7f0656f39e122073e0e3284ec7f5d021 Mon Sep 17 00:00:00 2001
From: Mike Frysinger <vapier@gentoo.org>
Date: Tue, 29 Mar 2016 23:35:44 -0400
Subject: [PATCH] libsandbox: fix symtab walking with some ELFs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The strtab assumption works if there is no SysV hash table.
Add logic to handle that scenario.
URL: https://bugs.gentoo.org/578524
Reported-by: Toralf Förster <toralf.foerster@gmx.de>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
---
libsandbox/wrapper-funcs/__wrapper_exec.c | 30 +++++++++++++++++-------------
1 file changed, 17 insertions(+), 13 deletions(-)
diff --git a/libsandbox/wrapper-funcs/__wrapper_exec.c b/libsandbox/wrapper-funcs/__wrapper_exec.c
index f7f51ab..d372366 100644
--- a/libsandbox/wrapper-funcs/__wrapper_exec.c
+++ b/libsandbox/wrapper-funcs/__wrapper_exec.c
@@ -83,10 +83,10 @@ static bool sb_check_exec(const char *filename, char *const argv[])
({ \
Elf##n##_Ehdr *ehdr = (void *)elf; \
Elf##n##_Phdr *phdr = (void *)(elf + ehdr->e_phoff); \
- Elf##n##_Addr vaddr, filesz, vsym = 0, vstr = 0; \
- Elf##n##_Off offset, symoff = 0, stroff = 0; \
+ Elf##n##_Addr vaddr, filesz, vsym = 0, vstr = 0, vhash = 0; \
+ Elf##n##_Off offset, symoff = 0, stroff = 0, hashoff = 0; \
Elf##n##_Dyn *dyn; \
- Elf##n##_Sym *sym; \
+ Elf##n##_Sym *sym, *symend; \
uint##n##_t ent_size = 0, str_size = 0; \
bool dynamic = false; \
size_t i; \
@@ -106,6 +106,7 @@ static bool sb_check_exec(const char *filename, char *const argv[])
case DT_SYMENT: ent_size = dyn->d_un.d_val; break; \
case DT_STRTAB: vstr = dyn->d_un.d_val; break; \
case DT_STRSZ: str_size = dyn->d_un.d_val; break; \
+ case DT_HASH: vhash = dyn->d_un.d_val; break; \
} \
++dyn; \
} \
@@ -123,6 +124,8 @@ static bool sb_check_exec(const char *filename, char *const argv[])
symoff = offset + (vsym - vaddr); \
if (vstr >= vaddr && vstr < vaddr + filesz) \
stroff = offset + (vstr - vaddr); \
+ if (vhash >= vaddr && vhash < vaddr + filesz) \
+ hashoff = offset + (vhash - vaddr); \
} \
\
/* Finally walk the symbol table. This should generally be fast as \
@@ -130,18 +133,20 @@ static bool sb_check_exec(const char *filename, char *const argv[])
* out there do not export any symbols at all. \
*/ \
if (symoff && stroff) { \
- sym = (void *)(elf + symoff); \
+ /* Hash entries are always 32-bits. */ \
+ uint32_t *hashes = (void *)(elf + hashoff); \
/* Nowhere is the # of symbols recorded, or the size of the symbol \
- * table. Instead, we do what glibc does: assume that the string \
- * table always follows the symbol table. This seems like a poor \
- * assumption to make, but glibc has gotten by this long. We could \
- * rely on DT_HASH and walking all the buckets to find the largest \
- * symbol index, but that's also a bit hacky. \
+ * table. Instead, we do what glibc does: use the sysv hash table \
+ * if it exists, else assume that the string table always directly \
+ * follows the symbol table. This seems like a poor assumption to \
+ * make, but glibc has gotten by this long. \
* \
* We don't sanity check the ranges here as you aren't executing \
* corrupt programs in the sandbox. \
*/ \
- for (i = 0; i < (vstr - vsym) / ent_size; ++i) { \
+ sym = (void *)(elf + symoff); \
+ symend = vhash ? (sym + hashes[1]) : (void *)(elf + stroff); \
+ while (sym < symend) { \
char *symname = (void *)(elf + stroff + sym->st_name); \
if (ELF##n##_ST_VISIBILITY(sym->st_other) == STV_DEFAULT && \
sym->st_shndx != SHN_UNDEF && sym->st_shndx < SHN_LORESERVE && \
@@ -149,9 +154,8 @@ static bool sb_check_exec(const char *filename, char *const argv[])
/* Minor optimization to avoid strcmp. */ \
symname[0] == '_' && symname[1] == '_') { \
/* Blacklist internal C library symbols. */ \
- size_t j; \
- for (j = 0; j < ARRAY_SIZE(libc_alloc_syms); ++j) \
- if (!strcmp(symname, libc_alloc_syms[j])) { \
+ for (i = 0; i < ARRAY_SIZE(libc_alloc_syms); ++i) \
+ if (!strcmp(symname, libc_alloc_syms[i])) { \
run_in_process = false; \
goto use_trace; \
} \
--
2.7.4
|