]> git.ipfire.org Git - thirdparty/glibc.git/commit
x32: Handle displacement overflow in PLT rewrite [BZ #31218]
authorH.J. Lu <hjl.tools@gmail.com>
Sat, 6 Jan 2024 22:03:37 +0000 (14:03 -0800)
committerH.J. Lu <hjl.tools@gmail.com>
Sat, 6 Jan 2024 22:25:49 +0000 (14:25 -0800)
commit0f9afc265a4a0f4ba658d7f71c9602a3fda3538e
tree1415b8a9d056e30603381edf9728ebb4a3b9f063
parentb96a2eba2fcca37deea221a18c998ee0084a5d21
x32: Handle displacement overflow in PLT rewrite [BZ #31218]

PLT rewrite calculated displacement with

ElfW(Addr) disp = value - branch_start - JMP32_INSN_SIZE;

On x32, displacement from 0xf7fbe060 to 0x401030 was calculated as

unsigned int disp = 0x401030 - 0xf7fbe060 - 5;

with disp == 0x8442fcb and caused displacement overflow. The PLT entry
was changed to:

0xf7fbe060 <+0>: e9 cb 2f 44 08      jmp    0x401030
0xf7fbe065 <+5>: cc                  int3
0xf7fbe066 <+6>: cc                  int3
0xf7fbe067 <+7>: cc                  int3
0xf7fbe068 <+8>: cc                  int3
0xf7fbe069 <+9>: cc                  int3
0xf7fbe06a <+10>: cc                  int3
0xf7fbe06b <+11>: cc                  int3
0xf7fbe06c <+12>: cc                  int3
0xf7fbe06d <+13>: cc                  int3
0xf7fbe06e <+14>: cc                  int3
0xf7fbe06f <+15>: cc                  int3

x32 has 32-bit address range, but it doesn't wrap address around at 4GB,
JMP target was changed to 0x100401030 (0xf7fbe060LL + 0x8442fcbLL + 5),
which is above 4GB.

Always use uint64_t to calculate displacement.  This fixes BZ #31218.
Reviewed-by: Noah Goldstein <goldstein.w.n@gmail.com>
sysdeps/x86_64/Makefile
sysdeps/x86_64/dl-machine.h
sysdeps/x86_64/tst-plt-rewrite2.c [new file with mode: 0644]
sysdeps/x86_64/tst-plt-rewritemod2.c [new file with mode: 0644]