From owner-freebsd-security@freebsd.org  Mon Oct  8 10:04:31 2018
Return-Path: <owner-freebsd-security@freebsd.org>
Delivered-To: freebsd-security@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2DFD710B9D82
 for <freebsd-security@mailman.ysv.freebsd.org>;
 Mon,  8 Oct 2018 10:04:31 +0000 (UTC) (envelope-from des@des.no)
Received: from smtp.des.no (smtp.des.no [194.63.250.102])
 by mx1.freebsd.org (Postfix) with ESMTP id C031D833A2
 for <freebsd-security@freebsd.org>; Mon,  8 Oct 2018 10:04:30 +0000 (UTC)
 (envelope-from des@des.no)
Received: from next.des.no (smtp.des.no [194.63.250.102])
 by smtp.des.no (Postfix) with ESMTP id 584A482A9;
 Mon,  8 Oct 2018 10:04:29 +0000 (UTC)
Received: by next.des.no (Postfix, from userid 1001)
 id A36BFB6B3; Mon,  8 Oct 2018 12:04:29 +0200 (CEST)
From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no>
To: Konstantin Belousov <kostikbel@gmail.com>
Cc: freebsd-security@freebsd.org
Subject: Re: [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-18:12.elf
In-Reply-To: <20181007224611.GI5335@kib.kiev.ua> (Konstantin Belousov's
 message of "Mon, 8 Oct 2018 01:46:11 +0300")
References: <20180912054309.61C6B13269@freefall.freebsd.org>
 <20181006173525.GC813@lena.kiev> <20181006182104.GS5335@kib.kiev.ua>
 <86sh1hs81t.fsf@next.des.no> <20181007224611.GI5335@kib.kiev.ua>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (berkeley-unix)
Date: Mon, 08 Oct 2018 12:04:29 +0200
Message-ID: <86pnwkhhzm.fsf@next.des.no>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Oct 2018 10:04:31 -0000

Konstantin Belousov <kostikbel@gmail.com> writes:
> Dag-Erling Sm=C3=B8rgrav <des@des.no> writes:
> > The string isn't just unterminated, though.  It's actually longer than
> > the section.  To be precise, "/lib/ld-linux.so.2" is 18 characters long,
> > plus NUL makes 19.  The section is supposed to be 17 bytes long.  I
> > don't mind forgiving a missing NUL, but I'm not comfortable with reading
> > past the end of the section, and it worries me that Linux doesn't care.
> Apparently it was not Linux.  Look at the astro/google-earth/Makefile
> before r425359.

Ah, I see.  The port used sed to edit the file in-place instead of using
a tool that understands Elf and would have adjusted the section length.
But it doesn't any more, probably because the linux_base ports install
ld-lsb.so.3, so what's the issue?  And regardless, your patch wouldn't
have helped in this case, since it would only have copied the first 17
characters ("/lib/ld-linux.so.", missing the final 2) to the new buffer.
So what is the rationale for the patch?

DES
--=20
Dag-Erling Sm=C3=B8rgrav - des@des.no