Re: [PATCH] malloc: Implement heap protector

[Florian Weimer <fweimer at redhat dot com>]

On 11/08/2016 04:13 PM, Florian Weimer wrote:
> diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
> index f68fdf4..801ded8 100644
> --- a/sysdeps/generic/ldsodefs.h
> +++ b/sysdeps/generic/ldsodefs.h
> @@ -607,6 +607,10 @@ struct rtld_global_ro
>    /* List of auditing interfaces.  */
>    struct audit_ifaces *_dl_audit;
>    unsigned int _dl_naudit;
> +
> +  /* malloc protection keys. */
> +  uintptr_t _dl_malloc_header_guard;
> +  uintptr_t _dl_malloc_footer_guard;
>  };
>  # define __rtld_global_attribute__
>  # if IS_IN (rtld)

This way of carrying information from ld.so to libc.so.6 does not work 
in the static dlopen case because rtld_global_ro is only initialized 
from the static initializer.  The code in security_init is never called, 
and so the two cookie values are always 0.

I believe this is a pre-existing bug in static dlopen, but I'll need to 
write a test case first.

Florian