commit a46298460ce7b7c13768fdf867492a4c3c9b1d15
author Fangrui Song <i@maskray.me> Sun Nov 28 14:47:57 2021 -0800
committer Copybara-Service <copybara-worker@google.com> Sun Nov 28 14:50:45 2021 -0800
tree b777232b7d0cd8e7cf47a0ad76ec5f422c23d571
parent f2ec6ab974ac2fcee14da281da427791e9a1ef93

[ELF] Fix out-of-bounds write in memset(&Out::first, ...)

Fix r285764: there is no guarantee that Out::first is placed before other
static data members of `struct Out`. After `bufferStart` was introduced, this
out-of-bounds write is destined in many compilers. It is likely benign, though.

And move `Out::elfHeader->size` assignment beside `Out::elfHeader->sectionIndex`

GitOrigin-RevId: d060cc1f9808dd5de524334fd695404a96e3175f

ELF/Driver.cpp

diff --git a/ELF/Driver.cpp b/ELF/Driver.cpp
index 5d306ea..6399a1f 100644
--- a/ELF/Driver.cpp
+++ b/ELF/Driver.cpp
@@ -2281,7 +2281,6 @@
   // Create elfHeader early. We need a dummy section in
   // addReservedSymbols to mark the created symbols as not absolute.
   Out::elfHeader = make<OutputSection>("", 0, SHF_ALLOC);
-  Out::elfHeader->size = sizeof(typename ELFT::Ehdr);
 
   std::vector<WrappedSymbol> wrapped = addWrappedSymbols(args);
 

ELF/OutputSections.cpp

diff --git a/ELF/OutputSections.cpp b/ELF/OutputSections.cpp
index 7b9cdc7..a17f713 100644
--- a/ELF/OutputSections.cpp
+++ b/ELF/OutputSections.cpp
@@ -33,7 +33,6 @@
 using namespace lld::elf;
 
 uint8_t *Out::bufferStart;
-uint8_t Out::first;
 PhdrEntry *Out::tlsPhdr;
 OutputSection *Out::elfHeader;
 OutputSection *Out::programHeaders;

ELF/OutputSections.h

diff --git a/ELF/OutputSections.h b/ELF/OutputSections.h
index 316fc33..a5b05cf 100644
--- a/ELF/OutputSections.h
+++ b/ELF/OutputSections.h
@@ -128,7 +128,6 @@
 // until Writer is initialized.
 struct Out {
   static uint8_t *bufferStart;
-  static uint8_t first;
   static PhdrEntry *tlsPhdr;
   static OutputSection *elfHeader;
   static OutputSection *programHeaders;

ELF/Writer.cpp

diff --git a/ELF/Writer.cpp b/ELF/Writer.cpp
index fc18e4f..adceb30 100644
--- a/ELF/Writer.cpp
+++ b/ELF/Writer.cpp
@@ -281,7 +281,10 @@
 template <class ELFT> void elf::createSyntheticSections() {
   // Initialize all pointers with NULL. This is needed because
   // you can call lld::elf::main more than once as a library.
-  memset(&Out::first, 0, sizeof(Out));
+  Out::tlsPhdr = nullptr;
+  Out::preinitArray = nullptr;
+  Out::initArray = nullptr;
+  Out::finiArray = nullptr;
 
   // Add the .interp section first because it is not a SyntheticSection.
   // The removeUnusedSyntheticSections() function relies on the
@@ -2054,6 +2057,7 @@
   // to 1 to make __ehdr_start defined. The section number is not
   // particularly relevant.
   Out::elfHeader->sectionIndex = 1;
+  Out::elfHeader->size = sizeof(typename ELFT::Ehdr);
 
   for (size_t i = 0, e = outputSections.size(); i != e; ++i) {
     OutputSection *sec = outputSections[i];