提交 731e8ffd 编写于 作者: R Rich Felker

ensure canary is setup if stack-prot libs are dlopen'd into non-ssp app

previously, this usage could lead to a crash if the thread pointer was
still uninitialized, and otherwise would just cause the canary to be
zero (less secure).
上级 2bd05a4f
...@@ -14,7 +14,8 @@ void __init_ssp(size_t *auxv) ...@@ -14,7 +14,8 @@ void __init_ssp(size_t *auxv)
for (i=0; auxv[i] && auxv[i]!=AT_RANDOM; i+=2); for (i=0; auxv[i] && auxv[i]!=AT_RANDOM; i+=2);
if (auxv[i]) memcpy(&canary, (void *)auxv[i+1], sizeof canary); if (auxv[i]) memcpy(&canary, (void *)auxv[i+1], sizeof canary);
else canary = (uintptr_t)&canary * 1103515245; else canary = (uintptr_t)&canary * 1103515245;
__stack_chk_guard = self->canary = canary; a_cas_l(&__stack_chk_guard, 0, canary);
self->canary = __stack_chk_guard;
} }
void __stack_chk_fail(void) void __stack_chk_fail(void)
......
...@@ -81,6 +81,7 @@ static int ldso_fail; ...@@ -81,6 +81,7 @@ static int ldso_fail;
static jmp_buf rtld_fail; static jmp_buf rtld_fail;
static pthread_rwlock_t lock; static pthread_rwlock_t lock;
static struct debug debug; static struct debug debug;
static size_t *auxv;
struct debug *_dl_debug_addr = &debug; struct debug *_dl_debug_addr = &debug;
...@@ -603,7 +604,7 @@ void _dl_debug_state(void) ...@@ -603,7 +604,7 @@ void _dl_debug_state(void)
void *__dynlink(int argc, char **argv) void *__dynlink(int argc, char **argv)
{ {
size_t *auxv, aux[AUX_CNT] = {0}; size_t aux[AUX_CNT] = {0};
size_t i; size_t i;
Phdr *phdr; Phdr *phdr;
Ehdr *ehdr; Ehdr *ehdr;
...@@ -838,6 +839,8 @@ void *dlopen(const char *file, int mode) ...@@ -838,6 +839,8 @@ void *dlopen(const char *file, int mode)
p->global = 1; p->global = 1;
} }
if (ssp_used) __init_ssp(auxv);
_dl_debug_state(); _dl_debug_state();
do_init_fini(tail); do_init_fini(tail);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册