HomeFreeBSD

rtld: fix SysV hash function overflow

Description

rtld: fix SysV hash function overflow

Quoting from https://maskray.me/blog/2023-04-12-elf-hash-function:

The System V Application Binary Interface (generic ABI) specifies the
ELF object file format. When producing an output executable or shared
object needing a dynamic symbol table (.dynsym), a linker generates a
.hash section with type SHT_HASH to hold a symbol hash table. A DT_HASH
tag is produced to hold the address of .hash.

The function is supposed to return a value no larger than 0x0fffffff.
Unfortunately, there is a bug. When unsigned long consists of more than
32 bits, the return value may be larger than UINT32_MAX. For instance,
elf_hash((const unsigned char *)"\xff\x0f\x0f\x0f\x0f\x0f\x12") returns
0x100000002, which is clearly unintended, as the function should behave
the same way regardless of whether long represents a 32-bit integer or
a 64-bit integer.

Reviewed by: kib, Fangrui Song
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D39517

(cherry picked from commit 29e3a06510823edbb91667d21f530d3ec778116d)

Details

Provenance
emasteAuthored on Apr 12 2023, 3:07 PM
Reviewer
kib
Differential Revision
D39517: rtld: fix SysV hash function overflow
Parents
rG937d152b3e62: rtld: reindent and style(9) elf_hash()
Branches
Unknown
Tags
Unknown