elf2flt: add patch "Fix buffer overflow in output_relocs()"
PATCH v2 1/1 elf2flt: add patch "Fix buffer overflow in output_relocs()"
This patches fixes the following crash:
make[1]: Entering directory `<...>/build/uclibc-1.0.14'
CC utils/getconf
*** buffer overflow detected ***: <...>/bin/elf2flt terminated ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x7338f)[0x2ad3be5f738f] /lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x2ad3be68ec9c] /lib/x86_64-linux-gnu/libc.so.6(+0x109b60)[0x2ad3be68db60] /lib/x86_64-linux-gnu/libc.so.6(+0x109069)[0x2ad3be68d069] /lib/x86_64-linux-gnu/libc.so.6(_IO_default_xsputn+0xbc)[0x2ad3be5ff70c] /lib/x86_64-linux-gnu/libc.so.6(_IO_vfprintf+0xaef)[0x2ad3be5ce7df] /lib/x86_64-linux-gnu/libc.so.6(__vsprintf_chk+0x84)[0x2ad3be68d0f4] /lib/x86_64-linux-gnu/libc.so.6(__sprintf_chk+0x7d)[0x2ad3be68d04d]
<...>/bin/elf2flt[0x403cda]
<...>/bin/elf2flt[0x4030a4]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x2ad3be5a5ec5]
<...>/bin/elf2flt[0x403642]
A pull-request has been sent for this patch to elf2flt developers, so we can remove it as soon as the patch is accepted upstream.
--- package/elf2flt/elf2flt.hash | 1 + package/elf2flt/elf2flt.mk | 1 + 2 files changed, 2 insertions(+)
package/elf2flt/elf2flt.hash +1 -0
@@ -1,2 +1,3 @@ # Locally calculated sha256 64ede6936aa88028378e08192039c29791b9e32714cc861762214b8e106e7145 elf2flt-8a3e74446fe7d866f0517ee089a37f4bdf4bc9f7.tar.gz +sha256 2659d8a7fca078dfe7ce9a3754d94a0cad3dc1fc7b8b0db5cf08f14bb34e4865 4595382ea76f85dced017b1b17b37ef9513458b6.patch
package/elf2flt/elf2flt.mk +1 -0
@@ -8,6 +8,7 @@ ELF2FLT_VERSION = 8a3e74446fe7d866f0517ee089a37f4bdf4bc9f7 ELF2FLT_SITE = $(call github,uclinux-dev,elf2flt,$(ELF2FLT_VERSION)) ELF2FLT_LICENSE = GPLv2+ ELF2FLT_LICENSE_FILES = LICENSE.TXT +ELF2FLT_PATCH = https://github.com/mcoquelin-stm32/elf2flt/commit/4595382ea76f85dced017b1b17b37ef9513458b6.patch HOST_ELF2FLT_DEPENDENCIES = host-binutils host-zlib
Signature · 1 line
1.9.1
PATCH v2 1/1 elf2flt: add patch "Fix buffer overflow in output_relocs()"
Quoted 40 lines · Maxime Coquelin
This patches fixes the following crash:
make[1]: Entering directory `<...>/build/uclibc-1.0.14'
CC utils/getconf
*** buffer overflow detected ***: <...>/bin/elf2flt terminated ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x7338f)[0x2ad3be5f738f] /lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x2ad3be68ec9c] /lib/x86_64-linux-gnu/libc.so.6(+0x109b60)[0x2ad3be68db60] /lib/x86_64-linux-gnu/libc.so.6(+0x109069)[0x2ad3be68d069] /lib/x86_64-linux-gnu/libc.so.6(_IO_default_xsputn+0xbc)[0x2ad3be5ff70c] /lib/x86_64-linux-gnu/libc.so.6(_IO_vfprintf+0xaef)[0x2ad3be5ce7df] /lib/x86_64-linux-gnu/libc.so.6(__vsprintf_chk+0x84)[0x2ad3be68d0f4] /lib/x86_64-linux-gnu/libc.so.6(__sprintf_chk+0x7d)[0x2ad3be68d04d]
<...>/bin/elf2flt[0x403cda]
<...>/bin/elf2flt[0x4030a4]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x2ad3be5a5ec5]
<...>/bin/elf2flt[0x403642]A pull-request has been sent for this patch to elf2flt developers, so we can remove it as soon as the patch is accepted upstream.
Signed-off-by Maxime Coquelin <[email protected]>--- package/elf2flt/elf2flt.hash | 1 + package/elf2flt/elf2flt.mk | 1 + 2 files changed, 2 insertions(+)package/elf2flt/elf2flt.hash +1
-0@@ -1,2 +1,3 @@ # Locally calculated sha256 64ede6936aa88028378e08192039c29791b9e32714cc861762214b8e106e7145 elf2flt-8a3e74446fe7d866f0517ee089a37f4bdf4bc9f7.tar.gz +sha256 2659d8a7fca078dfe7ce9a3754d94a0cad3dc1fc7b8b0db5cf08f14bb34e4865 4595382ea76f85dced017b1b17b37ef9513458b6.patchpackage/elf2flt/elf2flt.mk +0
-0
package/elf2flt/elf2flt.mk ELF2FLT_VERSION = 8a3e74446fe7d866f0517ee089a37f4bdf4bc9f7 · line 11
Quoted 4 lines
package/elf2flt/elf2flt.mk +1
-0@@ -8,6 +8,7 @@ ELF2FLT_VERSION = 8a3e74446fe7d866f0517ee089a37f4bdf4bc9f7 ELF2FLT_SITE = $(call github,uclinux-dev,elf2flt,$(ELF2FLT_VERSION)) ELF2FLT_LICENSE = GPLv2+ ELF2FLT_LICENSE_FILES = LICENSE.TXT +ELF2FLT_PATCH = https://github.com/mcoquelin-stm32/elf2flt/commit/4595382ea76f85dced017b1b17b37ef9513458b6.patch
I generally suggest to download patches rather than putting them in buildroot.
However, I meant this for patches that are upstream (for some definition of upstream, e.g. could be debian or gentoo). So that we have some chance of them being maintained over time. I'm not so fond of downloading patches from a random github fork; in that case, I think it's better to have the patch in buildroot itself.
In your commit message, you write:
Quoted 6 lines
Indeed, the maximum theorical size is 20 bytes (16 bytes for the value + 3 bytes for "+0x" + the end of string marker).
The reason the value overflows 32bits is yet to be understood, as the ARMV7-M is 32bits architecture, but this patch first ensure the sprintf call is robust enough.
Isn't that because we're subtracting a long from an int, so if it becomes
negative, it will be 0xffffffffnnnnnnnn?
Regards,
Arnout
Quoted 4 lines
HOST_ELF2FLT_DEPENDENCIES= host-binutils host-zlib
Signature · 6 lines
Arnout Vandecappelle arnout at mind be Senior Embedded Software Architect +32-16-286500 Essensium/Mind http://www.mind.be G.Geenslaan 9, 3001 Leuven, Belgium BE 872 984 063 RPR Leuven LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle GPG fingerprint: 7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF
PATCH v2 1/1 elf2flt: add patch "Fix buffer overflow in output_relocs()"
2016-04-20 23:12 GMT+02:00 Arnout Vandecappelle <[email protected]>:
Quoted 1 line · Maxime Coquelin
...
Quoted 12 lines
Quoted 10 lines
package/elf2flt/elf2flt.mk +1
-0@@ -8,6 +8,7 @@ ELF2FLT_VERSION = 8a3e74446fe7d866f0517ee089a37f4bdf4bc9f7 ELF2FLT_SITE = $(call github,uclinux-dev,elf2flt,$(ELF2FLT_VERSION)) ELF2FLT_LICENSE = GPLv2+ ELF2FLT_LICENSE_FILES = LICENSE.TXT +ELF2FLT_PATCH =https://github.com/mcoquelin-stm32/elf2flt/commit/4595382ea76f85dced017b1b17b37ef9513458b6.patch
Quoted 6 lines
I generally suggest to download patches rather than putting them in
buildroot. However, I meant this for patches that are upstream (for some definition of upstream, e.g. could be debian or gentoo). So that we have some chance of them being maintained over time. I'm not so fond of downloading patches from a random github fork; in that case, I think it's better to have the patch in buildroot itself.
Ok, I understand.
In the mean time, the patch has been accepted by the elf2flt maintainer, so I will send a v3 just changing the ELF2FLT_VERSION.
Quoted 14 lines
In your commit message, you write:
Quoted 8 lines
Indeed, the maximum theorical size is 20 bytes (16 bytes for the value + 3 bytes for "+0x" + the end of string marker).
The reason the value overflows 32bits is yet to be understood, as the ARMV7-M
is 32bits architecture, but this patch first ensure the sprintf call is robust
enough.
Quoted 2 lines
Isn't that because we're subtracting a long from an int, so if it becomes
negative, it will be 0xffffffffnnnnnnnn?
Certainly, yes.
But what I meant is that I for now didn't went far enough in the investigation to
understand why we obtain this negative value.
Thanks,
Maxime