/usr/src/libexec/ld.so/loader.c

Bug Summary

File:	src/libexec/ld.so/loader.c
Warning:	line 562, column 21 Access to field 'load_list' results in a dereference of a null pointer (loaded from variable 'exe_obj')

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name loader.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/libexec/ld.so/obj -resource-dir /usr/local/lib/clang/13.0.0 -D DO_CLEAN_BOOT -I /usr/src/libexec/ld.so -I /usr/src/libexec/ld.so/amd64 -D DEF_WEAK(x)=asm("") -D DEF_STRONG(x)=asm("") -D strsep=_dl_strsep -D strlcat=_dl_strlcat -D strlen=_dl_strlen -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/libexec/ld.so/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fno-builtin -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/libexec/ld.so/loader.c

1/*	$OpenBSD: loader.c,v 1.195 2022/01/08 06:49:41 guenther Exp $ */

3/*
* Copyright (c) 1998 Per Fogelstrom, Opsycon AB
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
*/

29#define	_DYN_LOADER

31#include <sys/types.h>
32#include <sys/mman.h>
33#include <sys/exec.h>
34#ifdef __i386__
35# include <machine/vmparam.h>
36#endif
37#include <string.h>
38#include <link.h>
39#include <limits.h>			/* NAME_MAX */
40#include <dlfcn.h>
41#include <tib.h>

43#include "syscall.h"
44#include "util.h"
45#include "resolve.h"
46#include "path.h"
47#include "sod.h"

49/*
* Local decls.
*/
52unsigned long _dl_boot(const char **, char **, const long, long *) __boot__attribute__((section(".boot.text")));
53void _dl_debug_state(void);
54void _dl_setup_env(const char *_argv0, char **_envp) __boot__attribute__((section(".boot.text")));
55void _dl_dtors(void);
56void _dl_dopreload(char *_paths) __boot__attribute__((section(".boot.text")));
57void _dl_fixup_user_env(void) __boot__attribute__((section(".boot.text")));
58void _dl_call_preinit(elf_object_t *) __boot__attribute__((section(".boot.text")));
59void _dl_call_init_recurse(elf_object_t *object, int initfirst);
60void _dl_clean_boot(void);
61static inline void unprotect_if_textrel(elf_object_t *_object);
62static inline void reprotect_if_textrel(elf_object_t *_object);
63static void _dl_rreloc(elf_object_t *_object);

65int _dl_pagesz __relro__attribute__((section(".data.rel.ro"))) = 4096;
66int _dl_bindnow __relro__attribute__((section(".data.rel.ro"))) = 0;
67int _dl_debug __relro__attribute__((section(".data.rel.ro"))) = 0;
68int _dl_trust __relro__attribute__((section(".data.rel.ro"))) = 0;
69char **_dl_libpath __relro__attribute__((section(".data.rel.ro"))) = NULL((void*)0);
70const char **_dl_argv __relro__attribute__((section(".data.rel.ro"))) = NULL((void*)0);
71int _dl_argc __relro__attribute__((section(".data.rel.ro"))) = 0;

73char *_dl_preload __boot_data__attribute__((section(".boot.data"))) = NULL((void*)0);
74char *_dl_tracefmt1 __boot_data__attribute__((section(".boot.data"))) = NULL((void*)0);
75char *_dl_tracefmt2 __boot_data__attribute__((section(".boot.data"))) = NULL((void*)0);
76char *_dl_traceprog __boot_data__attribute__((section(".boot.data"))) = NULL((void*)0);
77void *_dl_exec_hint __boot_data__attribute__((section(".boot.data"))) = NULL((void*)0);

79char **environ = NULL((void*)0);
80char *__progname = NULL((void*)0);

82int _dl_traceld;
83struct r_debug *_dl_debug_map;

85static dl_cb_cb _dl_cb_cb;
86const struct dl_cb_0 callbacks_0 = {
.dl_allocate_tib	= &_dl_allocate_tib,
.dl_free_tib		= &_dl_free_tib,
89#if DO_CLEAN_BOOT1
.dl_clean_boot		= &_dl_clean_boot,
91#endif
.dlopen			= &dlopen,
.dlclose		= &dlclose,
.dlsym			= &dlsym,
.dladdr			= &dladdr,
.dlctl			= &dlctl,
.dlerror		= &dlerror,
.dl_iterate_phdr	= &dl_iterate_phdr,
99};


102/*
* Run dtors for a single object.
*/
105void
106_dl_run_dtors(elf_object_t *obj)
107{
if (obj->dynDyn.u.fini_array) {
int num = obj->dynDyn.u.fini_arraysz / sizeof(Elf_AddrElf64_Addr);
int i;

DL_DEB(("doing finiarray obj %p @%p: [%s]\n",do { if (_dl_debug) _dl_printf ("doing finiarray obj %p @%p: [%s]\n"
, obj, obj->Dyn.u.fini_array, obj->load_name) ; } while
 (0)
    obj, obj->dyn.fini_array, obj->load_name))do { if (_dl_debug) _dl_printf ("doing finiarray obj %p @%p: [%s]\n"
, obj, obj->Dyn.u.fini_array, obj->load_name) ; } while
 (0);
for (i = num; i > 0; i--)
	(*obj->dynDyn.u.fini_array[i-1])();
}

if (obj->dynDyn.u.fini) {
DL_DEB(("doing dtors obj %p @%p: [%s]\n",do { if (_dl_debug) _dl_printf ("doing dtors obj %p @%p: [%s]\n"
, obj, obj->Dyn.u.fini, obj->load_name) ; } while (0)
    obj, obj->dyn.fini, obj->load_name))do { if (_dl_debug) _dl_printf ("doing dtors obj %p @%p: [%s]\n"
, obj, obj->Dyn.u.fini, obj->load_name) ; } while (0);
(*obj->dynDyn.u.fini)();
}
123}

125/*
* Run dtors for all objects that are eligible.
*/
128void
129_dl_run_all_dtors(void)
130{
elf_object_t *node;
int fini_complete;
int skip_initfirst;
int initfirst_skipped;

fini_complete = 0;
skip_initfirst = 1;
initfirst_skipped = 0;

while (fini_complete == 0) {
fini_complete = 1;
for (node = _dl_objects;
    node != NULL((void*)0);
    node = node->next) {
	if ((node->dynDyn.u.fini || node->dynDyn.u.fini_array) &&
	    (OBJECT_REF_CNT(node)((node->refcount + node->opencount + node->grprefcount
)) == 0) &&
	    (node->status & STAT_INIT_DONE0x004) &&
	    ((node->status & STAT_FINI_DONE0x008) == 0)) {
		if (skip_initfirst &&
		    (node->obj_flags & DF_1_INITFIRST0x00000020))
			initfirst_skipped = 1;
		else
			node->status |= STAT_FINI_READY0x010;
	    }
}
for (node = _dl_objects;
    node != NULL((void*)0);
    node = node->next ) {
	if ((node->dynDyn.u.fini || node->dynDyn.u.fini_array) &&
	    (OBJECT_REF_CNT(node)((node->refcount + node->opencount + node->grprefcount
)) == 0) &&
	    (node->status & STAT_INIT_DONE0x004) &&
	    ((node->status & STAT_FINI_DONE0x008) == 0) &&
	    (!skip_initfirst ||
	    (node->obj_flags & DF_1_INITFIRST0x00000020) == 0)) {
		struct object_vector vec = node->child_vec;
		int i;

		for (i = 0; i < vec.len; i++)
			vec.vec[i]->status &= ~STAT_FINI_READY0x010;
	}
}


for (node = _dl_objects;
    node != NULL((void*)0);
    node = node->next ) {
	if (node->status & STAT_FINI_READY0x010) {
		fini_complete = 0;
		node->status |= STAT_FINI_DONE0x008;
		node->status &= ~STAT_FINI_READY0x010;
		_dl_run_dtors(node);
	}
}

if (fini_complete && initfirst_skipped)
	fini_complete = initfirst_skipped = skip_initfirst = 0;
}
188}

190/*
* Routine to walk through all of the objects except the first
* (main executable).
*
* Big question, should dlopen()ed objects be unloaded before or after
* the destructor for the main application runs?
*/
197void
198_dl_dtors(void)
199{
_dl_thread_kern_stop();

/* ORDER? */
_dl_unload_dlopen();

DL_DEB(("doing dtors\n"))do { if (_dl_debug) _dl_printf ("doing dtors\n") ; } while (0
);

_dl_objects->opencount--;
_dl_notify_unload_shlib(_dl_objects);

_dl_run_all_dtors();
211}

213#if DO_CLEAN_BOOT1
214void
215_dl_clean_boot(void)
216{
extern char boot_text_start[], boot_text_end[];
218#if 0	/* XXX breaks boehm-gc?!? */
extern char boot_data_start[], boot_data_end[];
220#endif

_dl_munmap(boot_text_start, boot_text_end - boot_text_start);
223#if 0	/* XXX breaks boehm-gc?!? */
_dl_munmap(boot_data_start, boot_data_end - boot_data_start);
225#endif
226}
227#endif /* DO_CLEAN_BOOT */

229void
230_dl_dopreload(char *paths)
231{
char		*cp, *dp;
elf_object_t	*shlib;
int		count;

dp = paths = _dl_strdup(paths);
if (dp == NULL((void*)0))
_dl_oom();

/* preallocate child_vec for the LD_PRELOAD objects */
count = 1;
while (*dp++ != '\0')
if (*dp == ':')
	count++;
object_vec_grow(&_dl_objects->child_vec, count);

dp = paths;
while ((cp = _dl_strsep(&dp, ":")) != NULL((void*)0)) {
shlib = _dl_load_shlib(cp, _dl_objects, OBJTYPE_LIB3,
    _dl_objects->obj_flags);
if (shlib == NULL((void*)0))
	_dl_die("can't preload library '%s'", cp);
_dl_add_object(shlib);
_dl_link_child(shlib, _dl_objects);
}
_dl_free(paths);
return;
258}

260/*
* grab interesting environment variables, zap bad env vars if
* issetugid, and set the exported environ and __progname variables
*/
264void
265_dl_setup_env(const char *argv0, char **envp)
266{
static char progname_storage[NAME_MAX255+1] = "";

/*
* Don't allow someone to change the search paths if he runs
* a suid program without credentials high enough.
*/
_dl_trust = !_dl_issetugid();
if (!_dl_trust) {	/* Zap paths if s[ug]id... */
_dl_unsetenv("LD_DEBUG", envp);
_dl_unsetenv("LD_LIBRARY_PATH", envp);
_dl_unsetenv("LD_PRELOAD", envp);
_dl_unsetenv("LD_BIND_NOW", envp);
} else {
/*
 * Get paths to various things we are going to use.
 */
_dl_debug = _dl_getenv("LD_DEBUG", envp) != NULL((void*)0);
_dl_libpath = _dl_split_path(_dl_getenv("LD_LIBRARY_PATH",
    envp));
_dl_preload = _dl_getenv("LD_PRELOAD", envp);
_dl_bindnow = _dl_getenv("LD_BIND_NOW", envp) != NULL((void*)0);
}

/* these are usable even in setugid processes */
_dl_traceld = _dl_getenv("LD_TRACE_LOADED_OBJECTS", envp) != NULL((void*)0);
_dl_tracefmt1 = _dl_getenv("LD_TRACE_LOADED_OBJECTS_FMT1", envp);
_dl_tracefmt2 = _dl_getenv("LD_TRACE_LOADED_OBJECTS_FMT2", envp);
_dl_traceprog = _dl_getenv("LD_TRACE_LOADED_OBJECTS_PROGNAME", envp);

environ = envp;

_dl_trace_setup(envp);

if (argv0 != NULL((void*)0)) {		/* NULL ptr if argc = 0 */
const char *p = _dl_strrchr(argv0, '/');

if (p == NULL((void*)0))
	p = argv0;
else
	p++;
_dl_strlcpy(progname_storage, p, sizeof(progname_storage));
}
__progname = progname_storage;
310}

312int
313_dl_load_dep_libs(elf_object_t *object, int flags, int booting)
314{
elf_object_t *dynobj;
Elf_DynElf64_Dyn *dynp;
unsigned int loop;
int libcount;
int depflags;

dynobj = object;
while (dynobj) {
DL_DEB(("examining: '%s'\n", dynobj->load_name))do { if (_dl_debug) _dl_printf ("examining: '%s'\n", dynobj->
load_name) ; } while (0);
libcount = 0;

/* propagate DF_1_NOW to deplibs (can be set by dynamic tags) */
depflags = flags | (dynobj->obj_flags & DF_1_NOW0x00000001);

for (dynp = dynobj->load_dyn; dynp->d_tag; dynp++) {
	if (dynp->d_tag == DT_NEEDED1) {
		libcount++;
	}
}

if ( libcount != 0) {
	struct listent {
		Elf_DynElf64_Dyn *dynp;
		elf_object_t *depobj;
	} *liblist;
	int *randomlist;

	liblist = _dl_reallocarray(NULL((void*)0), libcount,
	    sizeof(struct listent));
	randomlist =  _dl_reallocarray(NULL((void*)0), libcount,
	    sizeof(int));

	if (liblist == NULL((void*)0) || randomlist == NULL((void*)0))
		_dl_oom();

	for (dynp = dynobj->load_dyn, loop = 0; dynp->d_tag;
	    dynp++)
		if (dynp->d_tag == DT_NEEDED1)
			liblist[loop++].dynp = dynp;

	/* Randomize these */
	for (loop = 0; loop < libcount; loop++)
		randomlist[loop] = loop;

	for (loop = 1; loop < libcount; loop++) {
		unsigned int rnd;
		int cur;
		rnd = _dl_arc4random();
		rnd = rnd % (loop+1);
		cur = randomlist[rnd];
		randomlist[rnd] = randomlist[loop];
		randomlist[loop] = cur;
	}

	for (loop = 0; loop < libcount; loop++) {
		elf_object_t *depobj;
		const char *libname;
		libname = dynobj->dynDyn.u.strtab;
		libname +=
		    liblist[randomlist[loop]].dynp->d_un.d_val;
		DL_DEB(("loading: %s required by %s\n", libname,do { if (_dl_debug) _dl_printf ("loading: %s required by %s\n"
, libname, dynobj->load_name) ; } while (0)
		    dynobj->load_name))do { if (_dl_debug) _dl_printf ("loading: %s required by %s\n"
, libname, dynobj->load_name) ; } while (0);
		depobj = _dl_load_shlib(libname, dynobj,
		    OBJTYPE_LIB3, depflags);
		if (depobj == 0) {
			if (booting) {
				_dl_die(
				    "can't load library '%s'",
				    libname);
			}
			DL_DEB(("dlopen: failed to open %s\n",do { if (_dl_debug) _dl_printf ("dlopen: failed to open %s\n"
, libname) ; } while (0)
			    libname))do { if (_dl_debug) _dl_printf ("dlopen: failed to open %s\n"
, libname) ; } while (0);
			_dl_free(liblist);
			_dl_free(randomlist);
			return (1);
		}
		liblist[randomlist[loop]].depobj = depobj;
	}

	object_vec_grow(&dynobj->child_vec, libcount);
	for (loop = 0; loop < libcount; loop++) {
		_dl_add_object(liblist[loop].depobj);
		_dl_link_child(liblist[loop].depobj, dynobj);
	}
	_dl_free(liblist);
	_dl_free(randomlist);
}
dynobj = dynobj->next;
}

_dl_cache_grpsym_list_setup(object);

return(0);
408}


411/* do any RWX -> RX fixups for executable PLTs and apply GNU_RELRO */
412static inline void
413_dl_self_relro(long loff)
414{
Elf_EhdrElf64_Ehdr *ehdp;
Elf_PhdrElf64_Phdr *phdp;
int i;

ehdp = (Elf_EhdrElf64_Ehdr *)loff;
phdp = (Elf_PhdrElf64_Phdr *)(loff + ehdp->e_phoff);
for (i = 0; i < ehdp->e_phnum; i++, phdp++) {
switch (phdp->p_type) {
423#if defined(__alpha__) || defined(__hppa__) || defined(__powerpc__) || \
  defined(__sparc64__)
case PT_LOAD1:
	if ((phdp->p_flags & (PF_X0x1 | PF_W0x2)) != (PF_X0x1 | PF_W0x2))
		break;
	_dl_mprotect((void *)(phdp->p_vaddr + loff),
	    phdp->p_memsz, PROT_READ0x01);
	break;
431#endif
case PT_GNU_RELRO0x6474e552:
	_dl_mprotect((void *)(phdp->p_vaddr + loff),
	    phdp->p_memsz, PROT_READ0x01);
	break;
}
}
438}


441#define PFLAGS(X)((((X) & 0x4) ? 0x01 : 0) | (((X) & 0x2) ? 0x02 : 0) |
 (((X) & 0x1) ? 0x04 : 0)) ((((X) & PF_R0x4) ? PROT_READ0x01 : 0) | \
   (((X) & PF_W0x2) ? PROT_WRITE0x02 : 0) | \
   (((X) & PF_X0x1) ? PROT_EXEC0x04 : 0))

445/*
* This is the dynamic loader entrypoint. When entering here, depending
* on architecture type, the stack and registers are set up according
* to the architectures ABI specification. The first thing required
* to do is to dig out all information we need to accomplish our task.
*/
451unsigned long
452_dl_boot(const char **argv, char **envp, const long dyn_loff, long *dl_data)
453{
struct elf_object *exe_obj;	/* Pointer to executable object */
struct elf_object *dyn_obj;	/* Pointer to ld.so object */
struct r_debug **map_link;	/* Where to put pointer for gdb */
struct r_debug *debug_map;
struct load_list *next_load, *load_list = NULL((void*)0);
Elf_DynElf64_Dyn *dynp;
Elf_PhdrElf64_Phdr *phdp;
Elf_EhdrElf64_Ehdr *ehdr;
char *us = NULL((void*)0);
unsigned int loop;
int failed;
struct dep_node *n;
Elf_AddrElf64_Addr minva, maxva, exe_loff, exec_end, cur_exec_end;
Elf_AddrElf64_Addr relro_addr = 0, relro_size = 0;
Elf_PhdrElf64_Phdr *ptls = NULL((void*)0);
int align;

if (dl_data[AUX_pagesz] != 0)
1
Assuming the condition is false→
2
←
Taking false branch→
_dl_pagesz = dl_data[AUX_pagesz];
_dl_malloc_init();

_dl_argv = argv;
while (_dl_argv[_dl_argc] != NULL((void*)0))
3
←
Loop condition is false. Execution continues on line 478→
_dl_argc++;
_dl_setup_env(argv[0], envp);

/*
* Make read-only the GOT and PLT and variables initialized
* during the ld.so setup above.
*/
_dl_self_relro(dyn_loff);

align = _dl_pagesz - 1;

488#define ROUND_PG(x)(((x) + align) & ~(align)) (((x) + align) & ~(align))
489#define TRUNC_PG(x)((x) & ~(align)) ((x) & ~(align))

if (_dl_bindnow) {
4
←
Assuming '_dl_bindnow' is 0→
5
←
Taking false branch→
/* Lazy binding disabled, so disable kbind */
_dl_kbind(NULL((void*)0), 0, 0);
}

DL_DEB(("ld.so loading: '%s'\n", __progname))do { if (_dl_debug) _dl_printf ("ld.so loading: '%s'\n", __progname
) ; } while (0);
6
←
Assuming '_dl_debug' is 0→
7
←
Taking false branch→
8
←
Loop condition is false.  Exiting loop→

/* init this in runtime, not statically */
TAILQ_INIT(&_dlopened_child_list)do { (&_dlopened_child_list)->tqh_first = ((void*)0); (
&_dlopened_child_list)->tqh_last = &(&_dlopened_child_list
)->tqh_first; } while (0);
9
←
Loop condition is false.  Exiting loop→

exe_obj = NULL((void*)0);
10
←
Null pointer value stored to 'exe_obj'→
_dl_loading_object = NULL((void*)0);

minva = ELF_NO_ADDR((__uint64_t) ~0);
maxva = exe_loff = exec_end = 0;

/*
* Examine the user application and set up object information.
*/
phdp = (Elf_PhdrElf64_Phdr *)dl_data[AUX_phdr];
for (loop = 0; loop < dl_data[AUX_phnum]; loop++) {
11
←
Assuming the condition is false→
12
←
Loop condition is false. Execution continues on line 562→
switch (phdp->p_type) {
case PT_PHDR6:
	exe_loff = (Elf_AddrElf64_Addr)dl_data[AUX_phdr] - phdp->p_vaddr;
	us += exe_loff;
	DL_DEB(("exe load offset:  0x%lx\n", exe_loff))do { if (_dl_debug) _dl_printf ("exe load offset:  0x%lx\n", exe_loff
) ; } while (0);
	break;
case PT_DYNAMIC2:
	minva = TRUNC_PG(minva)((minva) & ~(align));
	maxva = ROUND_PG(maxva)(((maxva) + align) & ~(align));
	exe_obj = _dl_finalize_object(argv[0] ? argv[0] : "",
	    (Elf_DynElf64_Dyn *)(phdp->p_vaddr + exe_loff),
	    (Elf_PhdrElf64_Phdr *)dl_data[AUX_phdr],
	    dl_data[AUX_phnum], OBJTYPE_EXE2, minva + exe_loff,
	    exe_loff);
	_dl_add_object(exe_obj);
	break;
case PT_INTERP3:
	us += phdp->p_vaddr;
	break;
case PT_LOAD1:
	if (phdp->p_vaddr < minva)
		minva = phdp->p_vaddr;
	if (phdp->p_vaddr > maxva)
		maxva = phdp->p_vaddr + phdp->p_memsz;

	next_load = _dl_calloc(1, sizeof(struct load_list));
	if (next_load == NULL((void*)0))
		_dl_oom();
	next_load->next = load_list;
	load_list = next_load;
	next_load->start = (char *)TRUNC_PG(phdp->p_vaddr)((phdp->p_vaddr) & ~(align)) + exe_loff;
	next_load->size = (phdp->p_vaddr & align) + phdp->p_filesz;
	next_load->prot = PFLAGS(phdp->p_flags)((((phdp->p_flags) & 0x4) ? 0x01 : 0) | (((phdp->p_flags
) & 0x2) ? 0x02 : 0) | (((phdp->p_flags) & 0x1) ? 0x04
 : 0));
	cur_exec_end = (Elf_AddrElf64_Addr)next_load->start + next_load->size;
	if ((next_load->prot & PROT_EXEC0x04) != 0 &&
	    cur_exec_end > exec_end)
		exec_end = cur_exec_end;
	break;
case PT_TLS7:
	if (phdp->p_filesz > phdp->p_memsz)
		_dl_die("invalid tls data");
	ptls = phdp;
	break;
case PT_GNU_RELRO0x6474e552:
	relro_addr = phdp->p_vaddr + exe_loff;
	relro_size = phdp->p_memsz;
	break;
}
phdp++;
}
exe_obj->load_list = load_list;
13
←
Access to field 'load_list' results in a dereference of a null pointer (loaded from variable 'exe_obj')
exe_obj->obj_flags |= DF_1_GLOBAL0x00000002;
exe_obj->load_size = maxva - minva;
exe_obj->relro_addr = relro_addr;
exe_obj->relro_size = relro_size;
_dl_set_sod(exe_obj->load_name, &exe_obj->sod);

569#ifdef __i386__
if (exec_end > I386_MAX_EXE_ADDR)
_dl_exec_hint = (void *)ROUND_PG(exec_end-I386_MAX_EXE_ADDR)(((exec_end-I386_MAX_EXE_ADDR) + align) & ~(align));
DL_DEB(("_dl_exec_hint:  0x%lx\n", _dl_exec_hint))do { if (_dl_debug) _dl_printf ("_dl_exec_hint:  0x%lx\n", _dl_exec_hint
) ; } while (0);
573#endif

/* TLS bits in the base executable */
if (ptls != NULL((void*)0) && ptls->p_memsz)
_dl_set_tls(exe_obj, ptls, exe_loff, NULL((void*)0));

n = _dl_malloc(sizeof *n);
if (n == NULL((void*)0))
_dl_oom();
n->data = exe_obj;
TAILQ_INSERT_TAIL(&_dlopened_child_list, n, next_sib)do { (n)->next_sib.tqe_next = ((void*)0); (n)->next_sib
.tqe_prev = (&_dlopened_child_list)->tqh_last; *(&
_dlopened_child_list)->tqh_last = (n); (&_dlopened_child_list
)->tqh_last = &(n)->next_sib.tqe_next; } while (0);
exe_obj->opencount++;

if (_dl_preload != NULL((void*)0))
_dl_dopreload(_dl_preload);

_dl_load_dep_libs(exe_obj, exe_obj->obj_flags, 1);

/*
* Now add the dynamic loader itself last in the object list
* so we can use the _dl_ code when serving dl.... calls.
* Intentionally left off the exe child_vec.
*/
dynp = (Elf_DynElf64_Dyn *)((void *)_DYNAMIC);
ehdr = (Elf_EhdrElf64_Ehdr *)dl_data[AUX_base];
dyn_obj = _dl_finalize_object(us, dynp,
   (Elf_PhdrElf64_Phdr *)((char *)dl_data[AUX_base] + ehdr->e_phoff),
   ehdr->e_phnum, OBJTYPE_LDR1, dl_data[AUX_base], dyn_loff);
_dl_add_object(dyn_obj);

dyn_obj->refcount++;
_dl_link_grpsym(dyn_obj);

dyn_obj->status |= STAT_RELOC_DONE0x001;
_dl_set_sod(dyn_obj->load_name, &dyn_obj->sod);

/* calculate the offsets for static TLS allocations */
_dl_allocate_tls_offsets();

/*
* Make something to help gdb when poking around in the code.
* Do this poking at the .dynamic section now, before relocation
* renders it read-only
*/
map_link = NULL((void*)0);
618#ifdef __mips__
if (exe_obj->Dyn.info[DT_MIPS_RLD_MAP - DT_LOPROC0x70000000 + DT_NUM(36 + 1)] != 0)
map_link = (struct r_debug **)(exe_obj->Dyn.info[
    DT_MIPS_RLD_MAP - DT_LOPROC0x70000000 + DT_NUM(36 + 1)] + exe_loff);
622#endif
if (map_link == NULL((void*)0)) {
for (dynp = exe_obj->load_dyn; dynp->d_tag; dynp++) {
	if (dynp->d_tag == DT_DEBUG21) {
		map_link = (struct r_debug **)&dynp->d_un.d_ptr;
		break;
	}
}
if (dynp->d_tag != DT_DEBUG21)
	DL_DEB(("failed to mark DTDEBUG\n"))do { if (_dl_debug) _dl_printf ("failed to mark DTDEBUG\n") ;
 } while (0);
}
if (map_link) {
debug_map = _dl_malloc(sizeof(*debug_map));
if (debug_map == NULL((void*)0))
	_dl_oom();
debug_map->r_version = 1;
debug_map->r_map = (struct link_map *)_dl_objects;
debug_map->r_brk = (Elf_AddrElf64_Addr)_dl_debug_state;
debug_map->r_state = RT_CONSISTENT;
debug_map->r_ldbase = dyn_loff;
_dl_debug_map = debug_map;
643#ifdef __mips__
relro_addr = exe_obj->relro_addr;
if (dynp->d_tag == DT_DEBUG21 &&
    ((Elf_AddrElf64_Addr)map_link + sizeof(*map_link) <= relro_addr ||
     (Elf_AddrElf64_Addr)map_link >= relro_addr + exe_obj->relro_size)) {
	_dl_mprotect(map_link, sizeof(*map_link),
	    PROT_READ0x01|PROT_WRITE0x02);
	*map_link = _dl_debug_map;
	_dl_mprotect(map_link, sizeof(*map_link),
	    PROT_READ0x01|PROT_EXEC0x04);
} else
654#endif
	*map_link = _dl_debug_map;
}


/*
* Everything should be in place now for doing the relocation
* and binding. Call _dl_rtld to do the job. Fingers crossed.
*/

failed = 0;
if (!_dl_traceld)
failed = _dl_rtld(_dl_objects);

if (_dl_debug || _dl_traceld) {
if (_dl_traceld)
	_dl_pledge("stdio rpath", NULL((void*)0));
_dl_show_objects();
}

DL_DEB(("dynamic loading done, %s.\n",do { if (_dl_debug) _dl_printf ("dynamic loading done, %s.\n"
, (failed == 0) ? "success":"failed") ; } while (0)
   (failed == 0) ? "success":"failed"))do { if (_dl_debug) _dl_printf ("dynamic loading done, %s.\n"
, (failed == 0) ? "success":"failed") ; } while (0);

if (failed != 0)
_dl_die("relocation failed");

if (_dl_traceld)
_dl_exit(0);

_dl_loading_object = NULL((void*)0);

/* set up the TIB for the initial thread */
_dl_allocate_first_tib();

_dl_fixup_user_env();

_dl_debug_state();

/*
* Do not run init code if run from ldd.
*/
if (_dl_objects->next != NULL((void*)0)) {
_dl_call_preinit(_dl_objects);
_dl_call_init(_dl_objects);
}

DL_DEB(("entry point: 0x%lx\n", dl_data[AUX_entry]))do { if (_dl_debug) _dl_printf ("entry point: 0x%lx\n", dl_data
[AUX_entry]) ; } while (0);

/*
* Return the entry point.
*/
return(dl_data[AUX_entry]);
706}

708int
709_dl_rtld(elf_object_t *object)
710{
struct load_list *llist;
int fails = 0;

if (object->next)
fails += _dl_rtld(object->next);

if (object->status & STAT_RELOC_DONE0x001)
return 0;

/*
* Do relocation information first, then GOT.
*/
unprotect_if_textrel(object);
_dl_rreloc(object);
fails =_dl_md_reloc(object, DT_REL17, DT_RELSZ18);
fails += _dl_md_reloc(object, DT_RELA7, DT_RELASZ8);
reprotect_if_textrel(object);

/*
* We do lazy resolution by default, doing eager resolution if
*  - the object requests it with -znow, OR
*  - LD_BIND_NOW is set and this object isn't being ltraced
*
* Note that -znow disables ltrace for the object: on at least
* amd64 'ld' doesn't generate the trampoline for lazy relocation
* when -znow is used.
*/
fails += _dl_md_reloc_got(object, !(object->obj_flags & DF_1_NOW0x00000001) &&
   !(_dl_bindnow && !object->traced));

/*
* Look for W&X segments and make them read-only.
*/
for (llist = object->load_list; llist != NULL((void*)0); llist = llist->next) {
if ((llist->prot & PROT_WRITE0x02) && (llist->prot & PROT_EXEC0x04)) {
	_dl_mprotect(llist->start, llist->size,
	    llist->prot & ~PROT_WRITE0x02);
}
}

if (fails == 0)
object->status |= STAT_RELOC_DONE0x001;

return (fails);
755}

757void
758_dl_call_preinit(elf_object_t *object)
759{
if (object->dynDyn.u.preinit_array) {
int num = object->dynDyn.u.preinit_arraysz / sizeof(Elf_AddrElf64_Addr);
int i;

DL_DEB(("doing preinitarray obj %p @%p: [%s]\n",do { if (_dl_debug) _dl_printf ("doing preinitarray obj %p @%p: [%s]\n"
, object, object->Dyn.u.preinit_array, object->load_name
) ; } while (0)
    object, object->dyn.preinit_array, object->load_name))do { if (_dl_debug) _dl_printf ("doing preinitarray obj %p @%p: [%s]\n"
, object, object->Dyn.u.preinit_array, object->load_name
) ; } while (0);
for (i = 0; i < num; i++)
	(*object->dynDyn.u.preinit_array[i])(_dl_argc, _dl_argv,
	    environ, &_dl_cb_cb);
}
770}

772void
773_dl_call_init(elf_object_t *object)
774{
_dl_call_init_recurse(object, 1);
_dl_call_init_recurse(object, 0);
777}

779static void
780_dl_relro(elf_object_t *object)
781{
/*
* Handle GNU_RELRO
*/
if (object->relro_addr != 0 && object->relro_size != 0) {
Elf_AddrElf64_Addr addr = object->relro_addr;

DL_DEB(("protect RELRO [0x%lx,0x%lx) in %s\n",do { if (_dl_debug) _dl_printf ("protect RELRO [0x%lx,0x%lx) in %s\n"
, addr, addr + object->relro_size, object->load_name) ;
 } while (0)
    addr, addr + object->relro_size, object->load_name))do { if (_dl_debug) _dl_printf ("protect RELRO [0x%lx,0x%lx) in %s\n"
, addr, addr + object->relro_size, object->load_name) ;
 } while (0);
_dl_mprotect((void *)addr, object->relro_size, PROT_READ0x01);
}
792}

794void
795_dl_call_init_recurse(elf_object_t *object, int initfirst)
796{
struct object_vector vec;
int visited_flag = initfirst ? STAT_VISIT_INITFIRST0x100 : STAT_VISIT_INIT0x200;
int i;

object->status |= visited_flag;

for (vec = object->child_vec, i = 0; i < vec.len; i++) {
if (vec.vec[i]->status & visited_flag)
	continue;
_dl_call_init_recurse(vec.vec[i], initfirst);
}

if (object->status & STAT_INIT_DONE0x004)
return;

if (initfirst && (object->obj_flags & DF_1_INITFIRST0x00000020) == 0)
return;

if (!initfirst)
_dl_relro(object);

if (object->dynDyn.u.init) {
DL_DEB(("doing ctors obj %p @%p: [%s]\n",do { if (_dl_debug) _dl_printf ("doing ctors obj %p @%p: [%s]\n"
, object, object->Dyn.u.init, object->load_name) ; } while
 (0)
    object, object->dyn.init, object->load_name))do { if (_dl_debug) _dl_printf ("doing ctors obj %p @%p: [%s]\n"
, object, object->Dyn.u.init, object->load_name) ; } while
 (0);
(*object->dynDyn.u.init)();
}

if (object->dynDyn.u.init_array) {
int num = object->dynDyn.u.init_arraysz / sizeof(Elf_AddrElf64_Addr);
int i;

DL_DEB(("doing initarray obj %p @%p: [%s]\n",do { if (_dl_debug) _dl_printf ("doing initarray obj %p @%p: [%s]\n"
, object, object->Dyn.u.init_array, object->load_name) ;
 } while (0)
    object, object->dyn.init_array, object->load_name))do { if (_dl_debug) _dl_printf ("doing initarray obj %p @%p: [%s]\n"
, object, object->Dyn.u.init_array, object->load_name) ;
 } while (0);
for (i = 0; i < num; i++)
	(*object->dynDyn.u.init_array[i])(_dl_argc, _dl_argv,
	    environ, &_dl_cb_cb);
}

if (initfirst)
_dl_relro(object);

object->status |= STAT_INIT_DONE0x004;
839}

841char *
842_dl_getenv(const char *var, char **env)
843{
const char *ep;

while ((ep = *env++)) {
const char *vp = var;

while (*vp && *vp == *ep) {
	vp++;
	ep++;
}
if (*vp == '\0' && *ep++ == '=')
	return((char *)ep);
}
return(NULL((void*)0));
857}

859void
860_dl_unsetenv(const char *var, char **env)
861{
char *ep;

while ((ep = *env)) {
const char *vp = var;

while (*vp && *vp == *ep) {
	vp++;
	ep++;
}
if (*vp == '\0' && *ep++ == '=') {
	char **P;

	for (P = env;; ++P)
		if (!(*P = *(P + 1)))
			break;
} else
	env++;
}
880}

882static inline void
883fixup_sym(struct elf_object *dummy_obj, const char *name, void *addr)
884{
struct sym_res sr;

sr = _dl_find_symbol(name, SYM_SEARCH_ALL0x00|SYM_NOWARNNOTFOUND0x00|SYM_PLT0x20,
   NULL((void*)0), dummy_obj);
if (sr.sym != NULL((void*)0)) {
void *p = (void *)(sr.sym->st_value + sr.obj->obj_base);
if (p != addr) {
	DL_DEB(("setting %s %p@%s[%p] from %p\n", name,do { if (_dl_debug) _dl_printf ("setting %s %p@%s[%p] from %p\n"
, name, p, sr.obj->load_name, (void *)sr.obj, addr) ; } while
 (0)
	    p, sr.obj->load_name, (void *)sr.obj, addr))do { if (_dl_debug) _dl_printf ("setting %s %p@%s[%p] from %p\n"
, name, p, sr.obj->load_name, (void *)sr.obj, addr) ; } while
 (0);
	*(void **)p = *(void **)addr;
}
}
897}

899/*
* _dl_fixup_user_env()
*
* Set the user environment so that programs can use the environment
* while running constructors. Specifically, MALLOC_OPTIONS= for malloc()
*/
905void
906_dl_fixup_user_env(void)
907{
struct elf_object dummy_obj;

dummy_obj.dynDyn.u.symbolic = 0;
dummy_obj.load_name = "ld.so";
fixup_sym(&dummy_obj, "environ", &environ);
fixup_sym(&dummy_obj, "__progname", &__progname);
914}

916const void *
917_dl_cb_cb(int version)
918{
DL_DEB(("version %d callbacks requested\n", version))do { if (_dl_debug) _dl_printf ("version %d callbacks requested\n"
, version) ; } while (0);
if (version == 0)
return &callbacks_0;
return NULL((void*)0);
923}

925static inline void
926unprotect_if_textrel(elf_object_t *object)
927{
struct load_list *ll;

if (__predict_false(object->dyn.textrel == 1)__builtin_expect(((object->Dyn.u.textrel == 1) != 0), 0)) {
for (ll = object->load_list; ll != NULL((void*)0); ll = ll->next) {
	if ((ll->prot & PROT_WRITE0x02) == 0)
		_dl_mprotect(ll->start, ll->size,
		    PROT_READ0x01 | PROT_WRITE0x02);
}
}
937}

939static inline void
940reprotect_if_textrel(elf_object_t *object)
941{
struct load_list *ll;

if (__predict_false(object->dyn.textrel == 1)__builtin_expect(((object->Dyn.u.textrel == 1) != 0), 0)) {
for (ll = object->load_list; ll != NULL((void*)0); ll = ll->next) {
	if ((ll->prot & PROT_WRITE0x02) == 0)
		_dl_mprotect(ll->start, ll->size, ll->prot);
}
}
950}

952static void
953_dl_rreloc(elf_object_t *object)
954{
const Elf_RelrElf64_Relr	*reloc, *rend;
Elf_AddrElf64_Addr	loff = object->obj_base;

reloc = object->dynDyn.u.relr;
rend  = (const Elf_RelrElf64_Relr *)((char *)reloc + object->dynDyn.u.relrsz);

while (reloc < rend) {
Elf_AddrElf64_Addr *where;

where = (Elf_AddrElf64_Addr *)(*reloc + loff);
*where++ += loff;

for (reloc++; reloc < rend && (*reloc & 1); reloc++) {
	Elf_AddrElf64_Addr bits = *reloc >> 1;

	Elf_AddrElf64_Addr *here = where;
	while (bits != 0) {
		if (bits & 1) {
			*here += loff;
		}
		bits >>= 1;
		here++;
	}
	where += (8 * sizeof *reloc) - 1;
}
}
981}
