From 968c3889223e6a6f948c4eb34a9376cfc1390811 Mon Sep 17 00:00:00 2001 From: Ben Scarlato Date: Sun, 28 Aug 2016 17:11:42 -0700 Subject: Updating ExploitabilityLinux to check memory mapping names against a prefix instead of a specific name. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This will prevent false positives on systems which use a format such as “[stack:69616]” for stack memory mapping names. Change-Id: I51aeda2fe856c1f37f0d18ac06cce69fec2fffa2 Reviewed-on: https://chromium-review.googlesource.com/377086 Reviewed-by: Mike Frysinger --- src/processor/exploitability_linux.cc | 21 +++++++++++++-------- src/processor/exploitability_unittest.cc | 2 ++ .../linux_stack_pointer_in_stack_alt_name.dmp | Bin 0 -> 38761 bytes 3 files changed, 15 insertions(+), 8 deletions(-) create mode 100644 src/processor/testdata/linux_stack_pointer_in_stack_alt_name.dmp (limited to 'src/processor') diff --git a/src/processor/exploitability_linux.cc b/src/processor/exploitability_linux.cc index c520059c..63056c43 100644 --- a/src/processor/exploitability_linux.cc +++ b/src/processor/exploitability_linux.cc @@ -54,14 +54,18 @@ namespace { +// Prefixes for memory mapping names. +constexpr char kHeapPrefix[] = "[heap"; +constexpr char kStackPrefix[] = "[stack"; + // This function in libc is called if the program was compiled with // -fstack-protector and a function's stack canary changes. -const char kStackCheckFailureFunction[] = "__stack_chk_fail"; +constexpr char kStackCheckFailureFunction[] = "__stack_chk_fail"; // This function in libc is called if the program was compiled with // -D_FORTIFY_SOURCE=2, a function like strcpy() is called, and the runtime // can determine that the call would overflow the target buffer. -const char kBoundsCheckFailureFunction[] = "__chk_fail"; +constexpr char kBoundsCheckFailureFunction[] = "__chk_fail"; #ifndef _WIN32 const unsigned int MAX_INSTRUCTION_LEN = 15; @@ -539,9 +543,9 @@ bool ExploitabilityLinux::StackPointerOffStack(uint64_t stack_ptr) { // Checks if the stack pointer maps to a valid mapping and if the mapping // is not the stack. If the mapping has no name, it is inconclusive whether // it is off the stack. - return !linux_maps || - (linux_maps->GetPathname().compare("") && - linux_maps->GetPathname().compare("[stack]")); + return !linux_maps || (linux_maps->GetPathname().compare("") && + linux_maps->GetPathname().compare( + 0, strlen(kStackPrefix), kStackPrefix)); } bool ExploitabilityLinux::ExecutableStackOrHeap() { @@ -551,9 +555,10 @@ bool ExploitabilityLinux::ExecutableStackOrHeap() { const MinidumpLinuxMaps *linux_maps = linux_maps_list->GetLinuxMapsAtIndex(i); // Check for executable stack or heap for each mapping. - if (linux_maps && - (!linux_maps->GetPathname().compare("[stack]") || - !linux_maps->GetPathname().compare("[heap]")) && + if (linux_maps && (!linux_maps->GetPathname().compare( + 0, strlen(kStackPrefix), kStackPrefix) || + !linux_maps->GetPathname().compare( + 0, strlen(kHeapPrefix), kHeapPrefix)) && linux_maps->IsExecutable()) { return true; } diff --git a/src/processor/exploitability_unittest.cc b/src/processor/exploitability_unittest.cc index 502edcc7..528ee5f2 100644 --- a/src/processor/exploitability_unittest.cc +++ b/src/processor/exploitability_unittest.cc @@ -161,6 +161,8 @@ TEST(ExploitabilityTest, TestLinuxEngine) { ExploitabilityFor("linux_inside_module_exe_region2.dmp")); ASSERT_EQ(google_breakpad::EXPLOITABILITY_INTERESTING, ExploitabilityFor("linux_stack_pointer_in_stack.dmp")); + ASSERT_EQ(google_breakpad::EXPLOITABILITY_INTERESTING, + ExploitabilityFor("linux_stack_pointer_in_stack_alt_name.dmp")); ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH, ExploitabilityFor("linux_stack_pointer_in_module.dmp")); ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH, diff --git a/src/processor/testdata/linux_stack_pointer_in_stack_alt_name.dmp b/src/processor/testdata/linux_stack_pointer_in_stack_alt_name.dmp new file mode 100644 index 00000000..55b34e8a Binary files /dev/null and b/src/processor/testdata/linux_stack_pointer_in_stack_alt_name.dmp differ -- cgit v1.2.1