From nobody Wed Apr 12 16:49:29 2023 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PxTFk1Sxxz4553m; Wed, 12 Apr 2023 16:49:30 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PxTFj5zL5z4lQc; Wed, 12 Apr 2023 16:49:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1681318169; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zqTbcz85ZjnsfJlsu6M/qdPJHiN72hXvke53AC2cA1o=; b=E/lurkbKuuF1x6EdpWOoI0YjVb97I+jTJHWq2ntkRU8HddfavDoLPjnriO9MoHmh2RP0Kv lAkYgqMSLTLYV3AF0QK6G7ehV+rffhkStc9EDBf1w1JUNV5DtGjl6Kde2LKVk5MZUoby7v 2LwA/QbfCGN4owDiqwKtAds6cx7k8mylZtUAmMwXneyuyx1DmM3jSoSVQs4X0m4TgCi/oQ qGMMKajiW02N4fqKvUztHhxdFZyk75uCdhxyVeabRAPMiNrWXOapDVZwyO/qfhoOzSqpSw mDvzXOU7P8krT7yA5ntAcZ6kSYktq0TV/6ALIyvCn2TJYdN9tnkhtmqh3aATjQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1681318169; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zqTbcz85ZjnsfJlsu6M/qdPJHiN72hXvke53AC2cA1o=; b=umsJTTW4ymlSKWsIlxVqwwQcctg42r4chLV6vjTjVdaUE9IIrS4uB0i5W2LPgHwt7EK/0J x7W2NFJLVHj+pxvJMSpPaSqM0A14buhnD8cK5/tbmGq/FVn/2DhKf0eJvr0qUzSlOZ4Pg7 Jn7P/gRDc4YCbdCCnqhMr+emY1ow4J4ltIY6cBoTDlr2BoRGkkpsN5TXTWYgrq8wIVrd5A Gh6W6EltUkuamfdkPdO7G2oOmnfoC5YBzPVQ0tEyJHchwwhProJAUDuNLQLFXTuJVwQJdb i8dVgOCjO59hfAmZE67jOlL/YPI01LRCn0oNupFqmwRR/9A4mh5W13ipr+qGPA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1681318169; a=rsa-sha256; cv=none; b=pxyUdZYWETI+S5Zncf6iV1Z54HpOAkni4JWfBDt4ybQSprmJBSwL908SWZf9DqD6SKoF87 KQnoNRoEiSeElGoFwPKX8cS2+hv7n4eenBVl4TAFKs3w3jB9tOeLH3PSraSmyg2rTlS5t6 z9shGZJSNzA0aIYV9W+wTt0wHLf1xIZcXr0aVHQxtellT+zyC2UhF/phL62QjgiJw3/Zit YQHF5P00wlH+SIGzcC2ZRQS4GoKV0VH69v3dfVDXHn3sI7G/wjHV6ql/M75plrJEY+NXu5 /8E7shfbpSx4vh/puGuhBiuYZLztw2EcjqxAzleVG6XwrCXIe0wPkoIQT49FKw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PxTFj526pz1716; Wed, 12 Apr 2023 16:49:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 33CGnTD3016792; Wed, 12 Apr 2023 16:49:29 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 33CGnTlH016791; Wed, 12 Apr 2023 16:49:29 GMT (envelope-from git) Date: Wed, 12 Apr 2023 16:49:29 GMT Message-Id: <202304121649.33CGnTlH016791@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Ed Maste Subject: git: 29e3a0651082 - main - rtld: fix SysV hash function overflow List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 29e3a06510823edbb91667d21f530d3ec778116d Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=29e3a06510823edbb91667d21f530d3ec778116d commit 29e3a06510823edbb91667d21f530d3ec778116d Author: Ed Maste AuthorDate: 2023-04-12 15:07:26 +0000 Commit: Ed Maste CommitDate: 2023-04-12 16:44:34 +0000 rtld: fix SysV hash function overflow Quoting from https://maskray.me/blog/2023-04-12-elf-hash-function: The System V Application Binary Interface (generic ABI) specifies the ELF object file format. When producing an output executable or shared object needing a dynamic symbol table (.dynsym), a linker generates a .hash section with type SHT_HASH to hold a symbol hash table. A DT_HASH tag is produced to hold the address of .hash. The function is supposed to return a value no larger than 0x0fffffff. Unfortunately, there is a bug. When unsigned long consists of more than 32 bits, the return value may be larger than UINT32_MAX. For instance, elf_hash((const unsigned char *)"\xff\x0f\x0f\x0f\x0f\x0f\x12") returns 0x100000002, which is clearly unintended, as the function should behave the same way regardless of whether long represents a 32-bit integer or a 64-bit integer. Reviewed by: kib, Fangrui Song Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D39517 --- libexec/rtld-elf/rtld.c | 15 ++++++--------- libexec/rtld-elf/rtld.h | 2 +- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c index 382b05191a81..0d2a2b6b4c24 100644 --- a/libexec/rtld-elf/rtld.c +++ b/libexec/rtld-elf/rtld.c @@ -1796,23 +1796,20 @@ donelist_check(DoneList *dlp, const Obj_Entry *obj) } /* - * Hash function for symbol table lookup. Don't even think about changing - * this. It is specified by the System V ABI. + * SysV hash function for symbol table lookup. It is a slightly optimized + * version of the hash specified by the System V ABI. */ -unsigned long +Elf32_Word elf_hash(const char *name) { const unsigned char *p = (const unsigned char *)name; - unsigned long h = 0; - unsigned long g; + Elf32_Word h = 0; while (*p != '\0') { h = (h << 4) + *p++; - if ((g = h & 0xf0000000) != 0) - h ^= g >> 24; - h &= ~g; + h ^= (h >> 24) & 0xf0; } - return (h); + return (h & 0x0fffffff); } /* diff --git a/libexec/rtld-elf/rtld.h b/libexec/rtld-elf/rtld.h index 807437af5ff3..2db73c767502 100644 --- a/libexec/rtld-elf/rtld.h +++ b/libexec/rtld-elf/rtld.h @@ -379,7 +379,7 @@ void dump_Elf_Rela(Obj_Entry *, const Elf_Rela *, u_long); */ uintptr_t rtld_round_page(uintptr_t); uintptr_t rtld_trunc_page(uintptr_t); -unsigned long elf_hash(const char *); +Elf32_Word elf_hash(const char *); const Elf_Sym *find_symdef(unsigned long, const Obj_Entry *, const Obj_Entry **, int, SymCache *, struct Struct_RtldLockState *); void lockdflt_init(void);