先看 code:
static void do_ctors_aux(void)
{
/* SGX RTS does not support .ctors currently */
fp_t *p = NULL;
uintptr_t init_array_addr;
size_t init_array_size;
const void *enclave_start = (const void*)&__ImageBase;
elf_get_init_array(enclave_start, &init_array_addr, &init_array_size);
if (init_array_addr == 0 || init_array_size == 0)
return;
fp_t *fp_start = (fp_t*)(init_array_addr + (uintptr_t)(enclave_start));
fp_t *fp_end = fp_start + (init_array_size / sizeof(fp_t));
/* traverse .init_array in forward order */
for (p = fp_start; p < fp_end; p++)
{
(*p)(); //使用 init_array_addr
}
}
init_array_array 本来应该在 elf_get_init_array() 里面被赋值的。
但是在 elf_get_init_array() 里面:
int elf_get_init_array(const void* enclave_base,
uintptr_t *init_array_addr, size_t *init_array_size)
{
ElfW(Half) phnum = 0;
const ElfW(Ehdr) *ehdr = (const ElfW(Ehdr)*)enclave_base;
ElfW(Phdr) *phdr = get_phdr(ehdr);
if (!init_array_addr || !init_array_size)
return -1;
if (phdr == NULL)
return -1; /* Invalid image. */
*init_array_addr = 0;
*init_array_size = 0;
/* Search for Dynamic segment */
for (; phnum < ehdr->e_phnum; phnum++, phdr++)
{
if (phdr->p_type == PT_DYNAMIC)
{
size_t count;
size_t n_dyn = phdr->p_filesz/sizeof(ElfW(Dyn));
ElfW(Dyn) *dyn = GET_PTR(ElfW(Dyn), ehdr, phdr->p_paddr);
for (count = 0; count < n_dyn; count++, dyn++)
{
switch (dyn->d_tag)
{
case DT_INIT_ARRAY:
*init_array_addr = dyn->d_un.d_ptr;
break;
case DT_INIT_ARRAYSZ:
*init_array_size = dyn->d_un.d_val;
break;
}
}
}
}
return 0;
}
整改办法:
在 do_ctors_aux()中增加 对 elf_get_init_array() 的返回值的判断。