[FFmpeg-devel] [FFmpeg-cvslog] r11100 - in trunk/libavcodec/i386: cavsdsp_mmx.c dsputil_mmx.c dsputil_mmx.h h264dsp_mmx.c mpegvideo_mmx.c vc1dsp_mmx.c

[Michael Niedermayer]

On Fri, Nov 30, 2007 at 09:11:12PM +0100, Michael Niedermayer wrote:
> On Fri, Nov 30, 2007 at 07:04:42PM +0200, Uoti Urpala wrote:
> > On Fri, 2007-11-30 at 12:26 +0100, Michael Niedermayer wrote:
> > > On Thu, Nov 29, 2007 at 03:53:47PM -0700, Loren Merritt wrote:
> > > > (1) static (like it was before)
> > > > (2) #pragma GCC visibility ...
> > > > (3) ld -Bsymbolic
> > > > (4) ld --version-script ...
> > > > (5) implement full PIC access (double deference, not just rip-relative).
> > > > 
> > > > (2) obvisouly requires gcc. (3) and (4) require GNU ld. (5) makes the 
> > > > shared library slower (I have no idea how much).
> > 
> > Would (3) or (4) actually fix compilation in this case? I think the
> > addressing mode generated by the compiler causes the problems and AFAIK
> > the linker wouldn't change that.
> 
> ive not tested it (no x86-64 here) but if loren says it solves the problem
> then iam sure it does
> the way i understand it is that
> * the x86-64 does not support displacement offsets >32bit
> * the toolchain seems to be designed around the idea that there are more
>   than 4gb of shared libs on your system but that a single lib would be less
>   than 4gb (and the hardware cant handle that with normal addressing)

> * the default is that all non static symbols are overrideable at
>   runtime (which means they could be overridden from libs which are outside
>   the reachable 4gb window in theory)

also having stuff from shared libs overrideable like they are makes
exploits easier, just change the pointer to whatever function you (dont) like.
like changing the free() pointer to the system() function (this also is
unaffected by non executable stack and heap ...)
Note, ive not tried above but it should work ...

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I have often repented speaking, but never of holding my tongue.
-- Xenocrates
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20071130/794b94c0/attachment.pgp>