commit 16f7f8d2503a9033a09a4d7e857561d63471bb82
author Yabin Cui <yabinc@google.com> Tue Nov 04 11:08:05 2014 -0800
committer Yabin Cui <yabinc@google.com> Tue Nov 04 14:37:15 2014 -0800
tree 6e90ea6e751a2a1b256a88d97e7a5fa81df80459
parent 695781b6f0419f82939176a6ec1a240300d9f036

check invalid file offset when loading library

Bug: 18178121
Bug: 18078224

Change-Id: I5254433d54645db68e9b83d5095dc2bf9d8531bc

linker/linker.cpp

diff --git a/linker/linker.cpp b/linker/linker.cpp
index ab0fc07..b2911b8 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -814,12 +814,20 @@
     DL_ERR("file offset for the library \"%s\" is not page-aligned: %" PRId64, name, file_offset);
     return nullptr;
   }
+  if (file_offset < 0) {
+    DL_ERR("file offset for the library \"%s\" is negative: %" PRId64, name, file_offset);
+    return nullptr;
+  }
 
   struct stat file_stat;
   if (TEMP_FAILURE_RETRY(fstat(fd, &file_stat)) != 0) {
     DL_ERR("unable to stat file for the library \"%s\": %s", name, strerror(errno));
     return nullptr;
   }
+  if (file_offset >= file_stat.st_size) {
+    DL_ERR("file offset for the library \"%s\" >= file size: %" PRId64 " >= %" PRId64, name, file_offset, file_stat.st_size);
+    return nullptr;
+  }
 
   // Check for symlink and other situations where
   // file can have different names.

tests/dlext_test.cpp

diff --git a/tests/dlext_test.cpp b/tests/dlext_test.cpp
index 58add6b..5b31364 100644
--- a/tests/dlext_test.cpp
+++ b/tests/dlext_test.cpp
@@ -17,8 +17,10 @@
 #include <gtest/gtest.h>
 
 #include <dlfcn.h>
+#include <elf.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <inttypes.h>
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
@@ -39,6 +41,9 @@
 #define ASSERT_NOERROR(i) \
     ASSERT_NE(-1, i) << "errno: " << strerror(errno)
 
+#define ASSERT_SUBSTR(needle, haystack) \
+    ASSERT_PRED_FORMAT2(::testing::IsSubstring, needle, haystack)
+
 
 typedef int (*fn)(void);
 #define LIBNAME "libdlext_test.so"
@@ -138,7 +143,7 @@
   ASSERT_TRUE(android_data != nullptr);
 
   char lib_path[PATH_MAX];
-  snprintf(lib_path, sizeof(lib_path), LIBZIPPATH, android_data);
+  snprintf(lib_path, sizeof(lib_path), LIBPATH, android_data);
 
   android_dlextinfo extinfo;
   extinfo.flags = ANDROID_DLEXT_USE_LIBRARY_FD | ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET;
@@ -149,11 +154,20 @@
   ASSERT_TRUE(handle_ == nullptr);
   ASSERT_STREQ("dlopen failed: file offset for the library \"libname_placeholder\" is not page-aligned: 17", dlerror());
 
-  extinfo.library_fd_offset = (5LL<<58) + PAGE_SIZE;
+  // Test an address above 2^44, for http://b/18178121 .
+  extinfo.library_fd_offset = (5LL<<48) + PAGE_SIZE;
   handle_ = android_dlopen_ext("libname_placeholder", RTLD_NOW, &extinfo);
-
   ASSERT_TRUE(handle_ == nullptr);
-  // TODO: Better error message when reading with offset > file_size
+  ASSERT_SUBSTR("dlopen failed: file offset for the library \"libname_placeholder\" >= file size", dlerror());
+
+  extinfo.library_fd_offset = 0LL - PAGE_SIZE;
+  handle_ = android_dlopen_ext("libname_placeholder", RTLD_NOW, &extinfo);
+  ASSERT_TRUE(handle_ == nullptr);
+  ASSERT_SUBSTR("dlopen failed: file offset for the library \"libname_placeholder\" is negative", dlerror());
+
+  extinfo.library_fd_offset = PAGE_SIZE;
+  handle_ = android_dlopen_ext("libname_placeholder", RTLD_NOW, &extinfo);
+  ASSERT_TRUE(handle_ == nullptr);
   ASSERT_STREQ("dlopen failed: \"libname_placeholder\" has bad ELF magic", dlerror());
 
   close(extinfo.library_fd);