mirror of
https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git
synced 2024-12-20 15:26:43 +01:00
708bc7c7b4
for the DT_IA64_PLT_RESERVE dynamic table entry. When a shared object
does not have any PLT relocations, the linker apparently doesn't find
it necessary to actually reserve the space for the BOR (Bind On
Reference) entries as pointed to by the DTE. As a result, relocatable
data in the PLT was overwritten, causing some unexpected control flow
with annoyingly predictable outcome: coredump.
To reproduce:
% echo 'int main() { return 0; }' > foo.c
% cc -o foo foo.c -lxpg4
|
||
|---|---|---|
| .. | ||
| atrun | ||
| bootpd | ||
| comsat | ||
| fingerd | ||
| ftpd | ||
| getNAME | ||
| getty | ||
| lukemftpd | ||
| mail.local | ||
| makekey | ||
| mknetid | ||
| named-xfer | ||
| pppoed | ||
| rbootd | ||
| revnetgroup | ||
| rexecd | ||
| rlogind | ||
| rpc.rquotad | ||
| rpc.rstatd | ||
| rpc.rusersd | ||
| rpc.rwalld | ||
| rpc.sprayd | ||
| rshd | ||
| rtld-aout | ||
| rtld-elf | ||
| save-entropy | ||
| smrsh | ||
| talkd | ||
| tcpd | ||
| telnetd | ||
| tftpd | ||
| xtend | ||
| ypxfr | ||
| Makefile | ||
| Makefile.inc | ||