hplip-3.{9,10}, blob lj-x86_32.so dynamically resolves its "statically" linked symbols
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
HPLIP |
New
|
Undecided
|
Unassigned |
Bug Description
Some blobs internal static libraries are not actually linked staticaly so its symbols being dynamically resolved along all libraries linked or loaded with the blob and its caller which cause usage by the blob libraries with imcompatible API/ABI.
Particularly, blob has built-in library jbigkit version about 1.6 and it interfere with a system library with the same name (i.e. libjbig.so). The bug arise when that system jbigkit library is version of 2.0 which is binary not compatible with 1.x. This cause stack corruption in lj-x86_32.so and segfaults in hpcups.
Possible reproduction steps:
1. 32bit GNU/Linux OS.
2. Recent libraries jbigkit 2.x and libtiff 4.x build with jbig support (i.e. linked against system libjbig.so).
3. Blob lj-x86_32.so (mine has md5 sum 30bdf8c844508a5
4. hpcups linked with that libtiff library.
5. Some execution of hpcups going through prnt/hpcups/
Expected results:
1. Function hp_encode_
2. jbg_enc_init() from sysyem library libjbig.so corrupts stack frame of hp_encode_
3. Just after call HPLJJBGCompress() at prnt/hpcups/
4. Depending on compiler options (usually optimization needed, i.e. -O1 or -O2 for gcc) this could cause segfault later in the hpcups.
Workarounds: add new entry in .dynamic section with value DT_SYMBOLIC (0x10)
of the lj-x86_32.so, which directs linker to use self symbols first while resolution. For library with the given above md5 sum it is sufficient to write one byte 0x10 at file offset 0xA068.