git@vger.kernel.org mailing list mirror (one of many)
 help / color / mirror / code / Atom feed
From: "Nguyễn Thái Ngọc Duy" <pclouds@gmail.com>
To: git@vger.kernel.org
Cc: "Junio C Hamano" <gitster@pobox.com>,
	"David Michael" <fedora.dm0@gmail.com>,
	"Nguyễn Thái Ngọc Duy" <pclouds@gmail.com>
Subject: [PATCH] Add getenv.so for catching invalid getenv() use via LD_PRELOAD
Date: Sat,  5 Jan 2013 15:55:46 +0700	[thread overview]
Message-ID: <1357376146-7155-1-git-send-email-pclouds@gmail.com> (raw)
In-Reply-To: <CAEvUa7niTJVfp8_kuWs50kvhfZ59F-yAuAmeOXEduHXOq-tRFA@mail.gmail.com>

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
---
 Perhaps this will help the getenv bug hunting (I assume we do the
 hunting on Linux platform only). So far it catches this and is stuck
 at getenv in git_pager().

  diff --git a/exec_cmd.c b/exec_cmd.c
  index 125fa6f..d8be5ce 100644
  --- a/exec_cmd.c
  +++ b/exec_cmd.c
  @@ -97,7 +97,7 @@ static void add_path(struct strbuf *out, const char *path)
   
   void setup_path(void)
   {
  -       const char *old_path = getenv("PATH");
  +       char *old_path = xstrdup(getenv("PATH"));
          struct strbuf new_path = STRBUF_INIT;
   
          add_path(&new_path, git_exec_path());
  @@ -110,6 +110,7 @@ void setup_path(void)
   
          setenv("PATH", new_path.buf, 1);
   
  +       free(old_path);
          strbuf_release(&new_path);
   }

 contrib/getenv/Makefile |  2 ++
 contrib/getenv/getenv.c | 67 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 contrib/getenv/Makefile
 create mode 100644 contrib/getenv/getenv.c

diff --git a/contrib/getenv/Makefile b/contrib/getenv/Makefile
new file mode 100644
index 0000000..4881b85
--- /dev/null
+++ b/contrib/getenv/Makefile
@@ -0,0 +1,2 @@
+getenv.so: getenv.c
+	$(CC) -g -shared -fPIC -ldl -o $@ $<
diff --git a/contrib/getenv/getenv.c b/contrib/getenv/getenv.c
new file mode 100644
index 0000000..e351e10
--- /dev/null
+++ b/contrib/getenv/getenv.c
@@ -0,0 +1,67 @@
+#include <gnu/lib-names.h>
+#include <sys/mman.h>
+#include <dlfcn.h>
+#include <execinfo.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+/* Global symbols for easy access from gdb */
+static char *getenv_current;
+static char *getenv_prev;
+
+/*
+ * Intercept standard getenv() via LD_PRELOAD. The return value is
+ * made inaccessible by the next getenv() call. This helps catch
+ * places that ignore the statement "The string pointed to may be
+ * overwritten by a subsequent call to getenv()" [1].
+ *
+ * The backtrace is appended after the env string, which may be
+ * helpful to identify where this getenv() is called in a core dump.
+ *
+ * [1] http://pubs.opengroup.org/onlinepubs/9699919799/functions/getenv.html
+ */
+char *getenv(const char *name)
+{
+	static char *(*libc_getenv)(const char*);
+	char *value;
+
+	if (!libc_getenv) {
+		void *libc = dlopen(LIBC_SO, RTLD_LAZY);
+		libc_getenv = dlsym(libc, "getenv");
+	}
+	if (getenv_current) {
+		mprotect(getenv_current, strlen(getenv_current) + 1, PROT_NONE);
+		getenv_prev = getenv_current;
+		getenv_current = NULL;
+	}
+
+	value = libc_getenv(name);
+	if (value) {
+		int len = strlen(value) + 1;
+		int backtrace_len = 0;
+		void *buffer[100];
+		char **symbols;
+		int i, n;
+
+		n = backtrace(buffer, 100);
+		symbols = backtrace_symbols(buffer, n);
+		if (symbols) {
+			for (i = 0;i < n; i++)
+				backtrace_len += strlen(symbols[i]) + 1; /* \n */
+			backtrace_len++; /* NULL */
+		}
+
+		getenv_current = mmap(NULL, len + backtrace_len, PROT_READ | PROT_WRITE,
+				   MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
+		memcpy(getenv_current, value, len);
+		value = getenv_current;
+
+		if (symbols) {
+			char *p = getenv_current + len;
+			for (i = 0; i < n; i++)
+				p += sprintf(p, "%s\n", symbols[i]);
+		}
+	}
+	return value;
+}
-- 
1.8.0.rc2.23.g1fb49df

  parent reply	other threads:[~2013-01-05  8:56 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2013-01-05  0:35 [BUG/PATCH] setup: Copy an environment variable to avoid overwrites David Michael
2013-01-05  1:17 ` Junio C Hamano
2013-01-05  2:15   ` David Michael
2013-01-05  4:32   ` Junio C Hamano
2013-01-05  2:45 ` Duy Nguyen
2013-01-05  4:38   ` Junio C Hamano
2013-01-05  6:24     ` Duy Nguyen
2013-01-05  6:47       ` Junio C Hamano
2013-01-05  8:55 ` Nguyễn Thái Ngọc Duy [this message]
2013-01-05 10:39   ` [PATCH] Add getenv.so for catching invalid getenv() use via LD_PRELOAD Matt Kraai
2013-01-05 11:37     ` Duy Nguyen
2013-01-05 22:53   ` Jonathan Nieder
2013-01-07 15:45   ` David Michael
2013-01-07 15:28 ` [BUG/PATCH] setup: Copy an environment variable to avoid overwrites Erik Faye-Lund

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: http://vger.kernel.org/majordomo-info.html

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1357376146-7155-1-git-send-email-pclouds@gmail.com \
    --to=pclouds@gmail.com \
    --cc=fedora.dm0@gmail.com \
    --cc=git@vger.kernel.org \
    --cc=gitster@pobox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://80x24.org/mirrors/git.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).