Bypass/Switch between/Select weak symbols

Question

In a trivial example:

#include <stdio.h>
#include <stdlib.h>

int main() {
   void* test = malloc(10);
   printf("%p\n", test);
   return 0;
}

When I step into malloc with gdb I end up in libc:

#0  __GI___libc_malloc (bytes=10) at malloc.c:3028
#1  0x000055555555469c in main () at test.c:7

If I compile with ASan gcc -fsanitize=address -g test.c -o test I end up intercepted by ASan:

#0  0x00007ffff6ef8a80 in malloc () from /usr/lib/x86_64-linux-gnu/libasan.so.4
#1  0x000055555555495c in main () at test.c:7

This is because ASan is loaded first and it exports a weak symbol:

$ readelf -W -a /usr/lib/x86_64-linux-gnu/libasan.so.4
...
   314: 00000000000dea80   479 FUNC    WEAK   DEFAULT   12 malloc
...

$ readelf -W -a test
...
Dynamic section at offset 0xd70 contains 30 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libasan.so.4]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
...

$ readelf -W -a /lib/x86_64-linux-gnu/libc.so.6
...
  1229: 00000000000970e0   923 FUNC    GLOBAL DEFAULT   13 malloc@@GLIBC_2.2.5
...

Is it possible to pin malloc to call the libc version rather than the ASan?

I tried the following with no success:

#include <stdio.h>
#include <stdlib.h>

__asm__(".symver malloc,malloc@GLIBC_2.2.5");
int main() {
   void* test = malloc(10);
   printf("%p\n", test);
   return 0;
}

$ ./test
ASAN:DEADLYSIGNAL
=================================================================
==4616==ERROR: AddressSanitizer: SEGV on unknown address 0x55f589f7294a (pc 0x55f589f72820 bp 0x7fff24457f70 sp 0x7fff24457f58 T0)
==4616==The signal is caused by a WRITE memory access.
    #0 0x55f589f7281f  (/home/vagrant/symbol-ver/test+0x81f)
    #1 0x55f589f7295b in main /home/vagrant/symbol-ver/test.c:7
    #2 0x7f5abfddeb96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #3 0x55f589f72869 in _start (/home/vagrant/symbol-ver/test+0x869)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/home/vagrant/symbol-ver/test+0x81f)
==4616==ABORTING

compare the `readelf` libc output and the `__asm__` statment, anything different happen with 1 vs 2 @ chars? — Milag, Jul 13 '20 at 19:17

score 0 · Answer 1 · answered Jul 21 '20 at 03:51

0

Is it possible to pin malloc to call the libc version rather than the ASan?

Sure: you can dlopen("libc.so.6", ...) and use dlsym("malloc", ...).

However, that is a useless thing to do in an ASan binary: as you discovered it will thoroughly screw up ASan memory accounting, resulting in a crash or bogus reports.

answered Jul 21 '20 at 03:51

Employed Russian

199,314
34
295
362

Thanks! So is it pretty much `dlsym("malloc", ...)` the same as `__asm__(".symver malloc,malloc@GLIBC_2.2.5");`? – Anastasios Andronidis Jul 23 '20 at 10:54
@AnastasiosAndronidis No, not _at all_ – Employed Russian Jul 23 '20 at 14:36

Bypass/Switch between/Select weak symbols

1 Answers1