This commit puts all libio vtables in a dedicated, read-only ELF
section, so that they are consecutive in memory. Before any indirect
jump, the vtable pointer is checked against the section boundaries,
and the process is terminated if the vtable pointer does not fall into
the special ELF section.
To enable backwards compatibility, a special flag variable
(_IO_accept_foreign_vtables), protected by the pointer guard, avoids
process termination if libio stream object constructor functions have
been called earlier. Such constructor functions are called by the GCC
2.95 libstdc++ library, and this mechanism ensures compatibility with
old binaries. Existing callers inside glibc of these functions are
adjusted to call the original functions, not the wrappers which enable
vtable compatiblity.
The compatibility mechanism is used to enable passing FILE * objects
across a static dlopen boundary, too.
This splits a considerable chunk of code from the main vfprintf
function. This will make it easier to remove the use of extend_alloca
from the positional argument handling code.
ChangeLog:
2014-03-17 Will Newton <will.newton@linaro.org>
* libio/genops.c: Check whether
_IO_JUMPS_OFFSET is defined with #ifdef rather
than #if.
* libio/libioP.h: Likewise.
* stdio-common/vfprintf.c: Likewise.
Partially revert commits 2b766585f9 and
de2fd463b1, which were intended to fix BZ#11741
but caused another, likely worse bug, namely that fwrite() and fputs() could,
in an error path, read data beyond the end of the specified buffer, and
potentially even write this data to the file.
Fix BZ#11741 properly by checking the return value from _IO_padn() in
stdio-common/vfprintf.c.
With help from Paul Eggert, Carlos O'Donell, and Roland McGrath.
* stdio-common/printf-parse.h (read_int): Change return type to
'int', return -1 on INT_MAX overflow.
* stdio-common/vfprintf.c (vfprintf): Validate width and precision
against overflow of INT_MAX. Set errno to EOVERFLOW when 'done'
overflows INT_MAX. Check for overflow of in-format-string precision
values properly. Use EOVERFLOW rather than ERANGE throughout. Use
SIZE_MAX not INT_MAX for integer overflow test.
* stdio-common/printf-parsemb.c: If read_int signals an overflow,
skip the construct in the format string but do not record anything.
* stdio-common/bug22.c: Adjust to test both width/prevision
INT_MAX overflow as well as total length INT_MAX overflow. Check
explicitly for proper errno values.
New types printf_arginfo_size_function, printf_va_arg_function.
Declare register_printf_specifier, register_printf_modifier,
register_printf_type.
* stdio-common/printf-parse.h (struct printf_spec): Add size element.
(union printf_arg): Add pa_user element.
Adjust __printf_arginfo_table type.
Add __printf_va_arg_table, __printf_modifier_table,
__handle_registered_modifier_mb, and __handle_registered_modifier_wc
declarations.
* stdio-common/printf-parsemb.c: Recognize registered modifiers.
If registered arginfo call failed try normal specifier.
* stdio-common/printf-prs.c: Pass additional parameter to arginfo
function.
* stdio-common/Makefile (routines): Add reg-modifier and reg-type.
* stdio-common/Versions: Export register_printf_modifier,
register_printf_type, and register_printf_specifier for GLIBC_2.10.
* stdio-common/reg-modifier.c: New file.
* stdio-common/reg-type.c: New file.
* stdio-common/reg-printf.c (__register_printf_specifier): New
function. Mostly the old __register_printf_function function but
uses locking and type of third parameter changed.
(__register_printf_function): Implement using
__register_printf_specifier.
* stdio-common/vfprintf.c (vfprintf): Collect argument sizes in
calls to arginfo functions. Allocate enough memory for user-defined
types. Call new va_arg functions to get user-defined types.
Try installed handlers even for existing format specifiers first.
* stdio-common/_i18n_number.h (_i18n_number_rewrite): Take additional
parameter for end of buffer. If temporary copy is too large use
malloc.
* stdio-common/vfprintf.c: Adjust for _i18n_number_rewrite
interface change.
* stdio-common/printf_fp.c (__printf_fp): Likewise.. Account for
string rewrite when allocating buffer.
void **.
* nss/nsswitch.h (service_user): Use void * type for KNOWN field.
* nss/nss_files/files-hosts.c (LINE_PARSER): Cast host_addr to
char * to avoid warning.
* nis/nss_nis/nis-hosts.c (LINE_PARSER): Likewise.
* timezone/Makefile (CFLAGS-zdump.c): Add -fwrapv.
* locale/programs/ld-ctype.c (ctype_finish, set_class_defaults,
allocate_arrays): Cast second argument to charmap_find_symbol
to char * to avoid warnings.
* locale/programs/repertoire.c (repertoire_new_char): Change
from_nr, to_nr and cnt to unsigned long, adjust printf format
string.
* locale/programs/ld-collate.c (insert_value, handle_ellipsis):
Cast second argument to new_element to char * to avoid warnings.
* locale/weightwc.h (findidx): Cast &extra[-i] to const int32_t *.
* intl/gettextP.h (struct loaded_domain): Change plural to const
struct expression *.
* intl/plural-eval.c (plural_eval): Change first argument to
const struct expression *.
* intl/plural-exp.c (EXTRACT_PLURAL_EXPRESSION): Change first
argument to const struct expression **.
* intl/plural-exp.h (EXTRACT_PLURAL_EXPRESSION, plural_eval): Adjust
prototypes.
* intl/loadmsgcat (_nl_unload_domain): Cast away const
in call to __gettext_free_exp.
* posix/fnmatch.c (fnmatch): Rearrange code to avoid maybe
unitialized wstring/wpattern var warnings.
* posix/runtests.c (struct a_test): Make data field const char *.
* stdio-common/tst-sprintf2.c (main): Don't declere u, v and buf
vars if not LDBL_MANT_DIG >= 106.
* stdio-common/Makefile (CFLAGS-vfwprintf.c): Add -Wno-unitialized.
* stdio-common/vfprintf.c (vfprintf): Cast first arugment to
__find_specmb to avoid warning.
* rt/tst-mqueue1.c (do_one_test): Add casts to avoid warnings.
* debug/test-strcpy_chk.c (do_tests, do_random_tests): Add casts
to avoid warnings.
* sysdeps/ieee754/ldbl-96/s_roundl.c (huge): Add L suffix to
initializer.
* sysdeps/unix/clock_gettime.c (clock_gettime): Only define
tv var when it will be actually used.
* sunrpc/rpc_cmsg.c (xdr_callmsg): Cast IXDR_PUT_* to void
to avoid warnings.
Florian Weimer
Joseph Myers
Paul Pluzhnikov
Jeff Law
Andreas Schwab
Will Newton
Ondřej Bílka
Allan McRae
Eric Biggers
Siddhesh Poyarekar
David S. Miller
H.J. Lu
Ulrich Drepper
Kees Cook
Paul Eggert
Petr Baudis
Andreas Schwab
Ulrich Drepper