ldd: check read return value to avoid unitialized struct fields [was "ldd: check {,p}read return value consistently"]

[Lucas]

Now with a better subject.

I was also wondering about the lack of pledge() other than the newly
added one. That goes because dlopen() can do anything?

Lucas <lu...@sexy.is> wrote:
> Hi,
> 
> I wanted to understand how the pledge execpromises commit worked in ldd
> and went to read it, and noticed that there is both a 
> 
>       if (read(fd, &ehdr, sizeof(ehdr)) < 0) {
> 
> and a
> 
>       if (pread(fd, phdr, size, ehdr.e_phoff) != size) {
> 
> In particular, the "read < 0" confused me quite a lot, but the manpage
> states that, if the file descriptor _is a regular file_ and there are
> enough bytes, it reads to completion. The check for a being a regular
> file is already in place, but there is nothing guarding against a short
> file, so check instead if read == sizeof(ehdr).
> 
> -Lucas


diff refs/heads/master refs/heads/ldd-read-rv
commit - 7b0c383483702d9a26856c2b4754abb44950ed82
commit + 862cbcc132ebcd92cb4b44eb1b453ea9ada0bbc3
blob - 9e8c5065cd843ff36d91efcb868b94ffd4c98365
blob + ad624d9cd0e72944b93e951de9b31f57a6258601
--- libexec/ld.so/ldd/ldd.c
+++ libexec/ld.so/ldd/ldd.c
@@ -118,7 +118,7 @@ doit(char *name)
                return 1;
        }
 
-       if (read(fd, &ehdr, sizeof(ehdr)) < 0) {
+       if (read(fd, &ehdr, sizeof(ehdr)) != sizeof(ehdr)) {
                warn("read(%s)", name);
                close(fd);
                return 1;