Open Radar

 
29-May-2012 08:24 PM Nico Weber:
Summary:
dlopen() crashes in sandboxed binary with LC_RPATH load commands

Steps to Reproduce:
Build a program that is sandboxed and that calls dlopen() with -Wl,-rpath,@executable_path/foo. Run it.

For example this program:

#include <dlfcn.h>
#include <sandbox.h>
int main() {
  char* err;
  sandbox_init(kSBXProfilePureComputation, SANDBOX_NAMED, &err);
 dlopen("/System/Library/Frameworks/ApplicationServices.framework/Frameworks/ATS.framework/Resources/libFontRegistry.dylib", RTLD_LAZY | RTLD_LOCAL);
}

This doesn't crash:
clang  foo.c -o foo   && ./foo

This does crash:
clang  foo.c -o foo -Wl,-rpath,@loader_path/foo  && ./foo
foo(47269) malloc: *** error for object 0x10000062c: pointer being freed was not allocated
*** set a breakpoint in malloc_error_break to debug



Expected Results:
dlopen() should fail, but not crash.

Actual Results:
It crashes.

Regression:
No.

Notes:

29-May-2012 08:24 PM Nico Weber:
'foo.c' was successfully uploaded