getservbyport_r: fix out-of-bounds buffer read

[musl] / src / ldso / dl_iterate_phdr.c

diff --git a/src/ldso/dl_iterate_phdr.c b/src/ldso/dl_iterate_phdr.c
index e55cbf7..9546dd3 100644 (file)
--- a/src/ldso/dl_iterate_phdr.c
+++ b/src/ldso/dl_iterate_phdr.c
@@ -1,9 +1,12 @@
 #include <elf.h>
 #include <link.h>
+#include "pthread_impl.h"
 #include "libc.h"
 
 #define AUX_CNT 38
 
+extern weak hidden const size_t _DYNAMIC[];
+
 static int static_dl_iterate_phdr(int(*callback)(struct dl_phdr_info *info, size_t size, void *data), void *data)
 {
        unsigned char *p;
@@ -20,6 +23,8 @@ static int static_dl_iterate_phdr(int(*callback)(struct dl_phdr_info *info, size
                phdr = (void *)p;
                if (phdr->p_type == PT_PHDR)
                        base = aux[AT_PHDR] - phdr->p_vaddr;
+               if (phdr->p_type == PT_DYNAMIC && _DYNAMIC)
+                       base = (size_t)_DYNAMIC - phdr->p_vaddr;
                if (phdr->p_type == PT_TLS)
                        tls_phdr = phdr;
        }
@@ -31,7 +36,7 @@ static int static_dl_iterate_phdr(int(*callback)(struct dl_phdr_info *info, size
        info.dlpi_subs  = 0;
        if (tls_phdr) {
                info.dlpi_tls_modid = 1;
-               info.dlpi_tls_data = (void *)(base + tls_phdr->p_vaddr);
+               info.dlpi_tls_data = __tls_get_addr((tls_mod_off_t[]){1,0});
        } else {
                info.dlpi_tls_modid = 0;
                info.dlpi_tls_data = 0;