Skip to content
Commit 0f9afc26 authored by H.J. Lu's avatar H.J. Lu
Browse files

x32: Handle displacement overflow in PLT rewrite [BZ #31218]



PLT rewrite calculated displacement with

ElfW(Addr) disp = value - branch_start - JMP32_INSN_SIZE;

On x32, displacement from 0xf7fbe060 to 0x401030 was calculated as

unsigned int disp = 0x401030 - 0xf7fbe060 - 5;

with disp == 0x8442fcb and caused displacement overflow. The PLT entry
was changed to:

0xf7fbe060 <+0>:	e9 cb 2f 44 08     	jmp    0x401030
0xf7fbe065 <+5>:	cc                 	int3
0xf7fbe066 <+6>:	cc                 	int3
0xf7fbe067 <+7>:	cc                 	int3
0xf7fbe068 <+8>:	cc                 	int3
0xf7fbe069 <+9>:	cc                 	int3
0xf7fbe06a <+10>:	cc                 	int3
0xf7fbe06b <+11>:	cc                 	int3
0xf7fbe06c <+12>:	cc                 	int3
0xf7fbe06d <+13>:	cc                 	int3
0xf7fbe06e <+14>:	cc                 	int3
0xf7fbe06f <+15>:	cc                 	int3

x32 has 32-bit address range, but it doesn't wrap address around at 4GB,
JMP target was changed to 0x100401030 (0xf7fbe060LL + 0x8442fcbLL + 5),
which is above 4GB.

Always use uint64_t to calculate displacement.  This fixes BZ #31218.
Reviewed-by: default avatarNoah Goldstein <goldstein.w.n@gmail.com>
parent b96a2eba
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment