arrfab / rpms / glibc

Forked from rpms/glibc 4 years ago
Clone

Blame SOURCES/glibc-rh1144133.patch

147e83
commit 62058ce612ed3459501b4c4332e268edfe977f59
147e83
Author: Carlos O'Donell <carlos@redhat.com>
147e83
Date:   Mon Sep 29 13:14:21 2014 -0400
147e83
147e83
    Correctly size profiling reloc table (bug 17411)
147e83
    
147e83
    During auditing or profiling modes the dynamic loader
147e83
    builds a cache of the relocated PLT entries in order
147e83
    to reuse them when called again through the same PLT
147e83
    entry. This way the PLT entry is never completed and
147e83
    the call into the resolver always results in profiling
147e83
    or auditing code running.
147e83
    
147e83
    The problem is that the PLT relocation cache size
147e83
    is not computed correctly. The size of the cache
147e83
    should be "Size of a relocation result structure"
147e83
    x "Number of PLT-related relocations". Instead the
147e83
    code erroneously computes "Size of a relocation
147e83
    result" x "Number of bytes worth of PLT-related
147e83
    relocations". I can only assume this was a mistake
147e83
    in the understanding of the value of DT_PLTRELSZ
147e83
    which is the number of bytes of PLT-related relocs.
147e83
    We do have a DT_RELACOUNT entry, which is a count
147e83
    for dynamic relative relocs, but we have no
147e83
    DT_PLTRELCOUNT and thus we need to compute it.
147e83
    
147e83
    This patch corrects the computation of the size of the
147e83
    relocation table used by the glibc profiling code.
147e83
    
147e83
    For more details see:
147e83
    https://sourceware.org/ml/libc-alpha/2014-09/msg00513.html
147e83
    
147e83
    	[BZ #17411]
147e83
    	* elf/dl-reloc.c (_dl_relocate_object): Allocate correct amount for
147e83
    	l_reloc_result.
147e83
147e83
diff --git glibc-2.17-c758a686/elf/dl-reloc.c glibc-2.17-c758a686/elf/dl-reloc.c
147e83
index d2c6dac..97a7119 100644
147e83
--- glibc-2.17-c758a686/elf/dl-reloc.c
147e83
+++ glibc-2.17-c758a686/elf/dl-reloc.c
147e83
@@ -279,8 +279,12 @@ _dl_relocate_object (struct link_map *l, struct r_scope_elem *scope[],
147e83
 			      l->l_name);
147e83
 	  }
147e83
 
147e83
-	l->l_reloc_result = calloc (sizeof (l->l_reloc_result[0]),
147e83
-				    l->l_info[DT_PLTRELSZ]->d_un.d_val);
147e83
+	size_t sizeofrel = l->l_info[DT_PLTREL]->d_un.d_val == DT_RELA
147e83
+			   ? sizeof (ElfW(Rela))
147e83
+			   : sizeof (ElfW(Rel));
147e83
+	size_t relcount = l->l_info[DT_PLTRELSZ]->d_un.d_val / sizeofrel;
147e83
+	l->l_reloc_result = calloc (sizeof (l->l_reloc_result[0]), relcount);
147e83
+
147e83
 	if (l->l_reloc_result == NULL)
147e83
 	  {
147e83
 	    errstring = N_("\