Skip to content
Snippets Groups Projects
user avatar
Vivek Das Mohapatra authored
When munging the ELF data structures from the capsule-export code path
via dl_iterate_phdr, we get the dynamic section size as a callback arg
so we can double-check we haven't ended up outside the memory region
we expect to be working on.

Unfortunately when using link_map traversal to do the same sort of thing
to install wrapper functions inside the capsule we don't have this
information. We were using SIZE_MAX on ELFCLASS64 to pass a "big enough"
size parameter but this calculation does not work on ELFCLASS32.

Rather than go out of our way to produce a bogus-but-big-enough value
we now pass 0 for the size and have the called functions know that they
can't do the double-check if passed a size of 0.

The last entry in the dyn section should have a D_TAG of DT_NULL
anyway so we'll only crash off the end of the dynamic section if
the linker is broken or malicious (which is probably not worth
defending against, all things considered).
25a00ab9
History
Name Last commit Last update