pkg://compat-glibc-2.3.2-95.30.src.rpm:14008569/glibc-execstack-fix3.patch  info  downloads

2004-03-04  Ulrich Drepper  <drepper@redhat.com>

	* elf/dl-open.c (dl_open_worker): Check that _dl_open is called
	from the right place.

--- libc/elf/dl-open.c	31 Jul 2003 07:34:54 -0000	1.102
+++ libc/elf/dl-open.c	5 Mar 2004 04:23:16 -0000	1.103
@@ -30,6 +30,7 @@
 #include <bits/libc-lock.h>
 #include <ldsodefs.h>
 #include <bp-sym.h>
+#include <gnu/lib-names.h>
 
 #include <dl-dst.h>
 
@@ -66,7 +67,10 @@ struct dl_open_args
 {
   const char *file;
   int mode;
-  const void *caller;
+  /* This is the caller of the dlopen() function.  */
+  const void *caller_dlopen;
+  /* This is the caller if _dl_open().  */
+  const void *caller_dl_open;
   struct link_map *map;
 };
 
@@ -152,6 +156,68 @@ add_to_global (struct link_map *new)
 }
 
 
+#ifdef SHARED
+static int
+internal_function
+check_libc_caller (const void *caller)
+{
+  static const char expected1[] = LIBC_SO;
+  static const char expected2[] = LIBDL_SO;
+
+  /* If we already know the address ranges, just test.  */
+  static const void *expected1_from;
+  static const void *expected1_to;
+  static const void *expected2_from;
+  static const void *expected2_to;
+
+  if (expected1_from == NULL)
+    {
+      /* The only other DSO which is allowed to call these functions is
+	 libdl.  Find the address range containing the caller.  */
+      struct link_map *l;
+
+      for (l = GL(dl_loaded); l != NULL; l = l->l_next)
+	if (strcmp (expected1, l->l_name) == 0)
+	  {
+	  is_1:
+	    expected1_from = (const void *) l->l_map_start;
+	    expected1_to = (const void *) l->l_map_end;
+	  }
+	else if (strcmp (expected1, l->l_name) == 0)
+	  {
+	  is_2:
+	    expected2_from = (const void *) l->l_map_start;
+	    expected2_to = (const void *) l->l_map_end;
+	  }
+	else
+	  {
+	    struct libname_list *runp = l->l_libname;
+
+	    while (runp != NULL)
+	      {
+		if (strcmp (expected1, runp->name) == 0)
+		  goto is_1;
+		else if (strcmp (expected2, runp->name) == 0)
+		  goto is_2;
+
+		runp = runp->next;
+	      }
+	  }
+
+      assert (expected1_from != NULL);
+    }
+
+  /* When there would be more than two expected caller we could use an
+     array for the values but for now this is cheaper.  */
+  if ((caller >= expected1_from && caller < expected1_to)
+      || (caller >= expected2_from && caller < expected2_to))
+    return 0;
+
+  return 1;
+}
+#endif
+
+
 static void
 dl_open_worker (void *a)
 {
@@ -166,11 +232,17 @@ dl_open_worker (void *a)
   bool any_tls;
 #endif
 
+#ifdef SHARED
+  /* Check whether _dl_open() has been called from a valid DSO.  */
+  if (check_libc_caller (args->caller_dl_open) != 0)
+    _dl_signal_error (0, "dlopen", NULL, N_("invalid caller"));
+#endif
+
   /* Maybe we have to expand a DST.  */
   dst = strchr (file, '$');
   if (__builtin_expect (dst != NULL, 0))
     {
-      const void *caller = args->caller;
+      const void *caller_dlopen = args->caller_dlopen;
       size_t len = strlen (file);
       size_t required;
       struct link_map *call_map;
@@ -185,8 +257,8 @@ dl_open_worker (void *a)
       /* We have to find out from which object the caller is calling.  */
       call_map = NULL;
       for (l = GL(dl_loaded); l; l = l->l_next)
-	if (caller >= (const void *) l->l_map_start
-	    && caller < (const void *) l->l_map_end)
+	if (caller_dlopen >= (const void *) l->l_map_start
+	    && caller_dlopen < (const void *) l->l_map_end)
 	  {
 	    /* There must be exactly one DSO for the range of the virtual
 	       memory.  Otherwise something is really broken.  */
@@ -484,7 +556,7 @@ dl_open_worker (void *a)
 
 void *
 internal_function
-_dl_open (const char *file, int mode, const void *caller)
+_dl_open (const char *file, int mode, const void *caller_dlopen)
 {
   struct dl_open_args args;
   const char *objname;
@@ -500,7 +572,8 @@ _dl_open (const char *file, int mode, co
 
   args.file = file;
   args.mode = mode;
-  args.caller = caller;
+  args.caller_dlopen = caller_dlopen;
+  args.caller_dl_open = RETURN_ADDRESS (0);
   args.map = NULL;
   errcode = _dl_catch_error (&objname, &errstring, dl_open_worker, &args);