[RuntimeDyld] Fixed buffer overflows with absolute symbols

[lhames]

LGTM.

Out of interest, how did you find this? If there's a nice test case that reproduces the overflows we could include it in the regression suite.

[MoritzS]

Thanks!

As part of a research project on a code-generating database system I am using LLVM to generate code and also link it with static libraries at runtime. I found a few bugs in RuntimeDyld most of which I submitted for a review. The biggest change that I haven't submitted yet is my implementation of TLS relocations (only for x86 for now) in RuntimeDyld. I know that long-term this will probably be replaced by JITLink but when I started working on that project, it didn't seem stable enough so I decided to extend RuntimeDyld.

llvm/lib/ExecutionEngine/RuntimeDyld/RuntimeDyld.cpp

 }
 
 void RuntimeDyldImpl::resolveLocalRelocations() {
   // Iterate over all outstanding relocations
   for (auto it = Relocations.begin(), e = Relocations.end(); it != e; ++it) {
     // The Section here (Sections[i]) refers to the section in which the
     // symbol for the relocation is located.  The SectionID in the relocation
     // entry provides the section to which the relocation will be applied.
-    int Idx = it->first;
-    uint64_t Addr = Sections[Idx].getLoadAddress();
+    unsigned Idx = it->first;
+    uint64_t Addr = getSectionLoadAddress(Idx);
     LLVM_DEBUG(dbgs() << "Resolving relocations Section #" << Idx << "\t"
                       << format("%p", (uintptr_t)Addr) << "\n");
     resolveRelocationList(it->second, Addr);
   }
   Relocations.clear();
 }
 
 void RuntimeDyldImpl::mapSectionAddress(const void *LocalAddress,
void RuntimeDyldImpl::reassignSectionAddress(unsigned SectionID,
   Sections[SectionID].setLoadAddress(Addr);
 }
 
 void RuntimeDyldImpl::resolveRelocationList(const RelocationList &Relocs,
                                             uint64_t Value) {
   for (unsigned i = 0, e = Relocs.size(); i != e; ++i) {
     const RelocationEntry &RE = Relocs[i];
     // Ignore relocations for sections that were not loaded
-    if (Sections[RE.SectionID].getAddress() == nullptr)
+    if (RE.SectionID != AbsoluteSymbolSection &&
+        Sections[RE.SectionID].getAddress() == nullptr)
       continue;
     resolveRelocation(RE, Value);
   }
 }
 
 void RuntimeDyldImpl::applyExternalSymbolRelocations(
     const StringMap<JITEvaluatedSymbol> ExternalSymbolMap) {
   for (auto &RelocKV : ExternalSymbolRelocations) {

llvm/lib/ExecutionEngine/RuntimeDyld/RuntimeDyldImpl.h

public:
   void setProcessAllSections(bool ProcessAllSections) {
     this->ProcessAllSections = ProcessAllSections;
   }
 
   virtual std::unique_ptr<RuntimeDyld::LoadedObjectInfo>
   loadObject(const object::ObjectFile &Obj) = 0;
 
   uint64_t getSectionLoadAddress(unsigned SectionID) const {
+    if (SectionID == AbsoluteSymbolSection)
+      return 0;
+    else
       return Sections[SectionID].getLoadAddress();
   }
 
   uint8_t *getSectionAddress(unsigned SectionID) const {
+    if (SectionID == AbsoluteSymbolSection)
+      return nullptr;
+    else
       return Sections[SectionID].getAddress();
   }
 
   StringRef getSectionContent(unsigned SectionID) const {
-    return StringRef(reinterpret_cast<char *>(Sections[SectionID].getAddress()),
-                     Sections[SectionID].getStubOffset() + getMaxStubSize());
+    if (SectionID == AbsoluteSymbolSection)
+      return {};
+    else
+      return StringRef(
+          reinterpret_cast<char *>(Sections[SectionID].getAddress()),
   }
 
   uint8_t* getSymbolLocalAddress(StringRef Name) const {
     // FIXME: Just look up as a function for now. Overly simple of course.
     // Work in progress.
     RTDyldSymbolTable::const_iterator pos = GlobalSymbolTable.find(Name);
     if (pos == GlobalSymbolTable.end())
       return nullptr;
JITEvaluatedSymbol getSymbol(StringRef Name) const {
     return JITEvaluatedSymbol(TargetAddr, SymEntry.getFlags());
   }
 
   std::map<StringRef, JITEvaluatedSymbol> getSymbolTable() const {
     std::map<StringRef, JITEvaluatedSymbol> Result;
 
     for (auto &KV : GlobalSymbolTable) {
       auto SectionID = KV.second.getSectionID();
-      uint64_t SectionAddr = 0;
-      if (SectionID != AbsoluteSymbolSection)
-        SectionAddr = getSectionLoadAddress(SectionID);
+      uint64_t SectionAddr = getSectionLoadAddress(SectionID);
       Result[KV.first()] =
         JITEvaluatedSymbol(SectionAddr + KV.second.getOffset(), KV.second.getFlags());
     }
 
     return Result;
   }
 
   void resolveRelocations();