[Bug dynamic-link/22370] New: open_verify should use p_align to align notes

["hjl.tools at gmail dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=22370

            Bug ID: 22370
           Summary: open_verify should use p_align to align notes
           Product: glibc
           Version: 2.27
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: hjl.tools at gmail dot com
  Target Milestone: ---

open_verify has

     /* Check .note.ABI-tag if present.  */
      for (ph = phdr; ph < &phdr[ehdr->e_phnum]; ++ph)
        if (ph->p_type == PT_NOTE && ph->p_filesz >= 32 && ph->p_align >= 4)
          {
            ElfW(Addr) size = ph->p_filesz;

            if (ph->p_offset + size <= (size_t) fbp->len)
              abi_note = (void *) (fbp->buf + ph->p_offset);
            else
              {
                abi_note = alloca (size);
                __lseek (fd, ph->p_offset, SEEK_SET);
                if (__libc_read (fd, (void *) abi_note, size) != size)
                  goto read_error;
              } 

            while (memcmp (abi_note, &expected_note, sizeof (expected_note)))
              {
#define ROUND(len) (((len) + sizeof (ElfW(Word)) - 1) & -sizeof (ElfW(Word)))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This works only when sizeof (ElfW(Word)) == ph->p_align.  Instead,
it should be replaced by ALIGN_UP (len, ph->align)

                ElfW(Addr) note_size = 3 * sizeof (ElfW(Word))
                                       + ROUND (abi_note[0])
                                       + ROUND (abi_note[1]);

                if (size - 32 < note_size)
                  {
                    size = 0;
                    break;
                  }
                size -= note_size;
                abi_note = (void *) abi_note + note_size;
              }

-- 
You are receiving this mail because:
You are on the CC list for the bug.