aboutsummaryrefslogtreecommitdiff
path: root/NEWS
diff options
context:
space:
mode:
authorH.J. Lu <hjl.tools@gmail.com>2020-12-28 05:28:49 -0800
committerH.J. Lu <hjl.tools@gmail.com>2021-01-13 14:30:42 -0800
commit1864775abc7301a0387fb137b622ee6d6d7f2fbd (patch)
tree98bc7c2668edf6560e6e6393e4ae99694a785bae /NEWS
parent420ade1f64470df358a497f156cb316beb079831 (diff)
downloadglibc-1864775abc7301a0387fb137b622ee6d6d7f2fbd.zip
glibc-1864775abc7301a0387fb137b622ee6d6d7f2fbd.tar.gz
glibc-1864775abc7301a0387fb137b622ee6d6d7f2fbd.tar.bz2
x86: Check IFUNC definition in unrelocated executable [BZ #20019]
Calling an IFUNC function defined in unrelocated executable also leads to segfault. Issue a fatal error message when calling IFUNC function defined in the unrelocated executable from a shared library. On x86, ifuncmain6pie failed with: [hjl@gnu-cfl-2 build-i686-linux]$ ./elf/ifuncmain6pie --direct ./elf/ifuncmain6pie: IFUNC symbol 'foo' referenced in '/export/build/gnu/tools-build/glibc-32bit/build-i686-linux/elf/ifuncmod6.so' is defined in the executable and creates an unsatisfiable circular dependency. [hjl@gnu-cfl-2 build-i686-linux]$ readelf -rW elf/ifuncmod6.so | grep foo 00003ff4 00000706 R_386_GLOB_DAT 0000400c foo_ptr 00003ff8 00000406 R_386_GLOB_DAT 00000000 foo 0000400c 00000401 R_386_32 00000000 foo [hjl@gnu-cfl-2 build-i686-linux]$ Remove non-JUMP_SLOT relocations against foo in ifuncmod6.so, which trigger the circular IFUNC dependency, and build ifuncmain6pie with -Wl,-z,lazy. (cherry picked from commits 6ea5b57afa5cdc9ce367d2b69a2cebfb273e4617 and 7137d682ebfcb6db5dfc5f39724718699922f06c)
Diffstat (limited to 'NEWS')
-rw-r--r--NEWS1
1 files changed, 1 insertions, 0 deletions
diff --git a/NEWS b/NEWS
index 6b3c7db..de7afbf 100644
--- a/NEWS
+++ b/NEWS
@@ -25,6 +25,7 @@ The following bugs are resolved with this release:
[16573] malloc: Set and reset all hooks for tracing
[18035] Fix pldd hang
+ [20019] NULL pointer dereference in libc.so.6 IFUNC due to uninitialized GOT
[20568] Fix crash in _IO_wfile_sync
[24155] x32 memcmp can treat positive length as 0 (if sign bit in RDX is set) (CVE-2019-7309)
[24164] Systemtap probes need to use "nr" constraint on 32-bit Arm