Fix bad pointer / leak in regex code

[thirdparty/glibc.git] / elf / dl-reloc.c

diff --git a/elf/dl-reloc.c b/elf/dl-reloc.c
index 0872636f1699104c2962888e9ac691cdad0c2876..e7fb8da276094fc50e0684483e0ef8dd98918500 100644 (file)
--- a/elf/dl-reloc.c
+++ b/elf/dl-reloc.c
@@ -1,5 +1,5 @@
 /* Relocate a shared object and resolve its references to other loaded objects.
-   Copyright (C) 1995-2015 Free Software Foundation, Inc.
+   Copyright (C) 1995-2019 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -25,8 +25,8 @@
 #include <sys/param.h>
 #include <sys/types.h>
 #include <_itoa.h>
+#include <libc-pointer-arith.h>
 #include "dynamic-link.h"
-#include <libc-internal.h>
 
 /* Statistics function.  */
 #ifdef SHARED
@@ -45,7 +45,6 @@
    directly, as static TLS should be rare and code handling it should
    not be inlined as much as possible.  */
 int
-internal_function
 _dl_try_allocate_static_tls (struct link_map *map)
 {
   /* If we've already used the variable with dynamic access, or if the
@@ -112,7 +111,7 @@ _dl_try_allocate_static_tls (struct link_map *map)
 }
 
 void
-internal_function __attribute_noinline__
+__attribute_noinline__
 _dl_allocate_static_tls (struct link_map *map)
 {
   if (map->l_tls_offset == FORCED_DYNAMIC_TLS_OFFSET
@@ -201,17 +200,6 @@ _dl_relocate_object (struct link_map *l, struct r_scope_elem *scope[],
            newp->start = PTR_ALIGN_DOWN (ph->p_vaddr, GLRO(dl_pagesize))
                          + (caddr_t) l->l_addr;
 
-           if (__mprotect (newp->start, newp->len, PROT_READ|PROT_WRITE) < 0)
-             {
-               errstring = N_("cannot make segment writable for relocation");
-             call_error:
-               _dl_signal_error (errno, l->l_name, NULL, errstring);
-             }
-
-#if (PF_R | PF_W | PF_X) == 7 && (PROT_READ | PROT_WRITE | PROT_EXEC) == 7
-           newp->prot = (PF_TO_PROT
-                         >> ((ph->p_flags & (PF_R | PF_W | PF_X)) * 4)) & 0xf;
-#else
            newp->prot = 0;
            if (ph->p_flags & PF_R)
              newp->prot |= PROT_READ;
@@ -219,7 +207,14 @@ _dl_relocate_object (struct link_map *l, struct r_scope_elem *scope[],
              newp->prot |= PROT_WRITE;
            if (ph->p_flags & PF_X)
              newp->prot |= PROT_EXEC;
-#endif
+
+           if (__mprotect (newp->start, newp->len, newp->prot|PROT_WRITE) < 0)
+             {
+               errstring = N_("cannot make segment writable for relocation");
+             call_error:
+               _dl_signal_error (errno, l->l_name, NULL, errstring);
+             }
+
            newp->next = textrels;
            textrels = newp;
          }
@@ -233,7 +228,8 @@ _dl_relocate_object (struct link_map *l, struct r_scope_elem *scope[],
 
     /* This macro is used as a callback from the ELF_DYNAMIC_RELOCATE code.  */
 #define RESOLVE_MAP(ref, version, r_type) \
-    (ELFW(ST_BIND) ((*ref)->st_info) != STB_LOCAL                            \
+    ((ELFW(ST_BIND) ((*ref)->st_info) != STB_LOCAL                           \
+      && __glibc_likely (!dl_symbol_visibility_binds_local_p (*ref)))        \
      ? ((__builtin_expect ((*ref) == l->l_lookup_cache.sym, 0)               \
         && elf_machine_type_class (r_type) == l->l_lookup_cache.type_class)  \
        ? (bump_num_cache_relocations (),                                     \
@@ -258,21 +254,13 @@ _dl_relocate_object (struct link_map *l, struct r_scope_elem *scope[],
     ELF_DYNAMIC_RELOCATE (l, lazy, consider_profiling, skip_ifunc);
 
 #ifndef PROF
-    if (__glibc_unlikely (consider_profiling))
+    if (__glibc_unlikely (consider_profiling)
+       && l->l_info[DT_PLTRELSZ] != NULL)
       {
        /* Allocate the array which will contain the already found
           relocations.  If the shared object lacks a PLT (for example
           if it only contains lead function) the l_info[DT_PLTRELSZ]
           will be NULL.  */
-       if (l->l_info[DT_PLTRELSZ] == NULL)
-         {
-           errstring = N_("%s: no PLTREL found in object %s\n");
-         fatal:
-           _dl_fatal_printf (errstring,
-                             RTLD_PROGNAME,
-                             l->l_name);
-         }
-
        size_t sizeofrel = l->l_info[DT_PLTREL]->d_un.d_val == DT_RELA
                           ? sizeof (ElfW(Rela))
                           : sizeof (ElfW(Rel));
@@ -283,7 +271,7 @@ _dl_relocate_object (struct link_map *l, struct r_scope_elem *scope[],
          {
            errstring = N_("\
 %s: out of memory to store relocation results for %s\n");
-           goto fatal;
+           _dl_fatal_printf (errstring, RTLD_PROGNAME, l->l_name);
          }
       }
 #endif
@@ -315,7 +303,7 @@ _dl_relocate_object (struct link_map *l, struct r_scope_elem *scope[],
 }
 
 
-void internal_function
+void
 _dl_protect_relro (struct link_map *l)
 {
   ElfW(Addr) start = ALIGN_DOWN((l->l_addr
@@ -335,7 +323,7 @@ cannot apply additional memory protection after relocation");
 }
 
 void
-internal_function __attribute_noinline__
+__attribute_noinline__
 _dl_reloc_bad_type (struct link_map *map, unsigned int type, int plt)
 {
 #define DIGIT(b)       _itoa_lower_digits[(b) & 0xf];