This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]
Other format:	[Raw text]

Re: [Patch][BZ 14594] Demangle function pointers before testing them

From: Jeff Law <law at redhat dot com>
To: Rich Felker <dalias at aerifal dot cx>
Cc: libc-alpha at sourceware dot org
Date: Thu, 20 Sep 2012 15:33:21 -0600
Subject: Re: [Patch][BZ 14594] Demangle function pointers before testing them
References: <505B88BC.9010503@redhat.com> <20120920211850.GP254@brightrain.aerifal.cx>

On 09/20/2012 03:18 PM, Rich Felker wrote:


Wouldn't the opposite problem also happen: if the clear pointer is
NULL, the mangled pointer would be equal to the guard, which is random
and might point to anything. If it's possible to arrange for the clear
pointer to be NULL, it seems that nop slides would make this an easy
attack vector...

Note the pointer was being demangled prior to using it in the indirect call, so what you'd end up with would be a call to zero. That can be exploited on a poorly configured systems IIRC.

jeff

References:
- [Patch][BZ 14594] Demangle function pointers before testing them
  - From: Jeff Law
- Re: [Patch][BZ 14594] Demangle function pointers before testing them
  - From: Rich Felker

Index Nav:	[Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav:	[Date Prev] [Date Next]	[Thread Prev] [Thread Next]