Uh oh!
There was an error while loading. Please reload this page.
Don't use env::current_exe with libbacktrace - #33554
Merged
Merged
Conversation
Member
There was a problem hiding this comment.
Could you elaborate here and indicate that it's a security concern for not reading an arbitrary executable? Basically emphasize the facts of:
- You can probably trick
current_exeto point at any file, or rather that's the worst case. - There's been at least one bug reported in libbacktrace for corrupt dwarf info
- We don't know of any other vulnerabilities, but at worse we assume that arbitrary code execution is possible with corrupt dwarf info to libbacktrace (until we find evidence to the contrary)
And thus we don't pass a pathname to libbacktrace
semarie
commented
May 11, 2016
Contributor
I agree with the comment of @alexcrichton. I expect also some tests should be marked ignored for some platforms (like |
sfackler
commented
May 11, 2016
MemberAuthor
Updated. I fixed run-pass/backtrace-debuginfo.rs - I guess we'll let the builders find out what other tests need to be fixed. |
alexcrichton
commented
May 11, 2016
Member
Manishearth added a commit
to Manishearth/rust
that referenced
this pull request
May 12, 2016
…hton Don't use env::current_exe with libbacktrace If the path we give to libbacktrace doesn't actually correspond to the current process, libbacktrace will segfault *at best*. cc rust-lang#21889 r? @alexcrichton cc @semarie
nagisa
commented
May 12, 2016
Member
This is probably the cause for http://buildbot.rust-lang.org/builders/auto-win-gnu-64-nopt-t/builds/4202/steps/test/logs/stdio. (rollup #33589) |
If the path we give to libbacktrace doesn't actually correspond to the current process, libbacktrace will segfault *at best*. cc rust-lang#21889
sfackler
commented
May 12, 2016
MemberAuthor
Thanks, fixed. @bors r=alexcrichton |
bors
commented
May 12, 2016
Collaborator
📌 Commit 9393e52 has been approved by |
eddyb added a commit
to eddyb/rust
that referenced
this pull request
May 13, 2016
…hton Don't use env::current_exe with libbacktrace If the path we give to libbacktrace doesn't actually correspond to the current process, libbacktrace will segfault *at best*. cc rust-lang#21889 r? @alexcrichton cc @semarie
Manishearth added a commit
to Manishearth/rust
that referenced
this pull request
May 14, 2016
…hton Don't use env::current_exe with libbacktrace If the path we give to libbacktrace doesn't actually correspond to the current process, libbacktrace will segfault *at best*. cc rust-lang#21889 r? @alexcrichton cc @semarie
bors added a commit
that referenced
this pull request
May 14, 2016
alexcrichton
commented
May 17, 2016
Member
Accepted for backport at libs triage |
aturon added a commit
that referenced
this pull request
May 17, 2016
| // be in "permanent memory", so we copy it to a static and then use the | ||
| // static as the pointer. | ||
| // Things don't work so well on not-Linux since libbacktrace can't track | ||
| // down that executable this is. We at one point used env::current_exe but |
Contributor
There was a problem hiding this comment.
is this meant to say: "down what executable this is. ..." ?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
If the path we give to libbacktrace doesn't actually correspond to the
current process, libbacktrace will segfault at best.
cc #21889
r? @alexcrichton
cc @semarie