[tor-bugs] #22853 [Applications/Tor Browser Sandbox]: Something in selfrando is totally braindamaged. (was: Something in Ubuntu's libraries is totally brain damaged.)

[Tor Bug Tracker & Wiki]

#22853: Something in selfrando is totally braindamaged.
----------------------------------------------+-------------------------
 Reporter:  yawning                           |          Owner:  yawning
     Type:  defect                            |         Status:  closed
 Priority:  Medium                            |      Milestone:
Component:  Applications/Tor Browser Sandbox  |        Version:
 Severity:  Normal                            |     Resolution:  fixed
 Keywords:                                    |  Actual Points:
Parent ID:                                    |         Points:
 Reviewer:                                    |        Sponsor:
----------------------------------------------+-------------------------

Comment (by yawning):

 This bothered me so I dug into it a bit more.  This is a selfrando bug.

 https://github.com/immunant/selfrando/blob/master/src/RandoLib/posix/bionic
 /upstream-openbsd/getenv.c#L56
 {{{
     int fd = _TRaP_libc_open("/proc/self/environ", O_RDONLY);
     if (fd == -1)
 return;
 }}}

 https://github.com/immunant/selfrando/blob/master/src/RandoLib/posix/bionic
 /arch-x86_64/syscalls/__openat.S
 {{{

 #include <private/bionic_asm.h>

 ENTRY(__openat)
     movq    %rcx, %r10
 #ifdef __NR_openat
     movl    $__NR_openat, %eax
     syscall
 #else
     mov     $-ENOSYS, %eax
 #endif
     ret
 END(__openat)
 .hidden _TRaP_libc___openat
 }}}

 `errno` is a libc-ism, and syscalls return everything via %rax.  So the
 check for success should be `if (fd < 0)`.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/22853#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online