Adhemerval Zanella bcae44ea85 elf: Only process multiple tunable once (BZ 31686) ... The 680c597e9c commit made loader reject ill-formatted strings by first tracking all set tunables and then applying them. However, it does not take into consideration if the same tunable is set multiple times, where parse_tunables_string appends the found tunable without checking if it was already in the list. It leads to a stack-based buffer overflow if the tunable is specified more than the total number of tunables. For instance: GLIBC_TUNABLES=glibc.malloc.check=2:... (repeat over the number of total support for different tunable). Instead, use the index of the tunable list to get the expected tunable entry. Since now the initial list is zero-initialized, the compiler might emit an extra memset and this requires some minor adjustment on some ports. Checked on x86_64-linux-gnu and aarch64-linux-gnu. Reported-by: Yuto Maeda <maeda@cyberdefense.jp> Reported-by: Yutaro Shimizu <shimizu@cyberdefense.jp> Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>		2024-05-07 12:16:36 -03:00
..
bits
fpu
multiarch
add_n.S
addmul_1.S
align-cpy.S
backtrace.h
dl-irel.h
dl-machine.h
dl-plt.h
dl-trampoline.S
hp-timing.h
Implies
jmpbuf-unwind.h
lshift.S
Makefile
memchr.S
memcmp.S
memcpy.S
memmove.S
memset.S
mul_1.S
pthread_spin_init.c
pthread_spin_lock.S
pthread_spin_trylock.S
pthread_spin_unlock.S
pthreaddef.h
qp_add.c
qp_cmp.c
qp_cmpe.c
qp_div.c
qp_dtoq.c
qp_feq.c
qp_fge.c
qp_fgt.c
qp_fle.c
qp_flt.c
qp_fne.c
qp_itoq.c
qp_mul.c
qp_neg.S
qp_qtod.c
qp_qtoi.c
qp_qtos.c
qp_qtoui.c
qp_qtoux.c
qp_qtox.c
qp_sqrt.c
qp_stoq.c
qp_sub.c
qp_uitoq.c
qp_util.c
qp_uxtoq.c
qp_xtoq.c
rawmemchr.S
rshift.S
rtld-memcpy.c
rtld-memmove.c
rtld-memset.c
sfp-machine.h
stackguard-macros.h
start.S
stpcpy.S
stpncpy.S
strcat.S
strchr.S
strcmp.S
strcpy.S
strcspn.S
strlen.S
strncmp.S
strncpy.S
strpbrk.S
strrchr.c
strspn.S
sub_n.S
submul_1.S
tst-audit.h
Versions