4BSD VAX loader bug

Steven M. Kramer smk at axiom.UUCP
Fri Feb 3 03:43:08 AEST 1984


I found a bug in the VAX 4.2BSD loader.  The bug probably exists
in other systems using the long names stuff.  In ldrand(), a
symbol is looked up from a lib to see if it is needed by the
program so far.  If not, it's supposed to leave.  Well, slookup()
returns a pointer to NULL is the symbol is not defined.  Here,
it's checking for a NULL pointer (a subtle difference) instead.
What happends is that a bizzarre reference takes place if *hp=0
that may or may not core dump.  The fix below is in a #ifdef AXIOM.

Also, I would suggest changing cfree() to free() in the references
in the loader.  (Note cfree() [which is around but not documented]
takes 3 args and free() takes only 1.  Only 1 are supplied to cfree().
[cfree:calloc::free:malloc for those who want to know]

	--many happy loads

---------------------------------------
ldrand()
{
	register struct nlist *sp, **hp;
	register struct ranlib *tp, *tplast;
	off_t loc;
	int nsymt = symx(nextsym);

	tplast = &tab[tnum-1];
	for (tp = tab; tp <= tplast; tp++) {
		if ((hp = slookup(tp->ran_un.ran_name)) == 0)
			continue;
		sp = *hp;
#ifdef AXIOM
		/*
		 * sp could be NULL.  If so, the symbol is not
		 * defined yet so don't bother with it.
		 * Steve Kramer 2/2/84 Axiom Technology
		 */
		if (sp == NULL)
			continue;
#endif
		if (sp->n_type != N_EXT+N_UNDF)
			continue;
		step(tp->ran_off);
		loc = tp->ran_off;
		while (tp < tplast && (tp+1)->ran_off == loc)
			tp++;
	}
	return (symx(nextsym) != nsymt);
}
-- 
	--steve kramer
	{allegra,genrad,ihnp4,utzoo,philabs,uw-beaver}!linus!axiom!smk	(UUCP)
	linus!axiom!smk at mitre-bedford					(MIL)



More information about the Comp.bugs.4bsd.ucb-fixes mailing list