Add simple exploitability analysis for Linux crashes.

https://breakpad.appspot.com/622002/



git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@1226 4c0a9323-5329-0410-9bdc-e9ce6186880e

src/processor/exploitability.cc

@@ -40,6 +40,7 @@
 #include "google_breakpad/processor/exploitability.h"
 #include "google_breakpad/processor/minidump.h"
 #include "google_breakpad/processor/process_state.h"
+#include "processor/exploitability_linux.h"
 #include "processor/exploitability_win.h"
 #include "processor/logging.h"
 
@@ -70,13 +71,15 @@ Exploitability *Exploitability::ExploitabilityForPlatform(
   switch (raw_system_info->platform_id) {
     case MD_OS_WIN32_NT:
     case MD_OS_WIN32_WINDOWS: {
-      platform_exploitability = new ExploitabilityWin(dump,
-                                                      process_state);
+      platform_exploitability = new ExploitabilityWin(dump, process_state);
+      break;
+    }
+    case MD_OS_LINUX: {
+      platform_exploitability = new ExploitabilityLinux(dump, process_state);
       break;
     }
     case MD_OS_MAC_OS_X:
     case MD_OS_IOS:
-    case MD_OS_LINUX:
     case MD_OS_UNIX:
     case MD_OS_SOLARIS:
     case MD_OS_ANDROID:

src/processor/exploitability_linux.cc

@@ -0,0 +1,86 @@
+// Copyright (c) 2013 Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// exploitability_linux.cc: Linux specific exploitability engine.
+//
+// Provides a guess at the exploitability of the crash for the Linux
+// platform given a minidump and process_state.
+//
+// Author: Matthew Riley
+
+#include "processor/exploitability_linux.h"
+
+#include "google_breakpad/processor/process_state.h"
+#include "google_breakpad/processor/call_stack.h"
+#include "google_breakpad/processor/stack_frame.h"
+
+namespace {
+
+// This function in libc is called if the program was compiled with
+// -fstack-protector and a function's stack canary changes.
+const char kStackCheckFailureFunction[] = "__stack_chk_fail";
+
+// This function in libc is called if the program was compiled with
+// -D_FORTIFY_SOURCE=2, a function like strcpy() is called, and the runtime
+// can determine that the call would overflow the target buffer.
+const char kBoundsCheckFailureFunction[] = "__chk_fail";
+
+}  // namespace
+
+namespace google_breakpad {
+
+ExploitabilityLinux::ExploitabilityLinux(Minidump *dump,
+                                         ProcessState *process_state)
+    : Exploitability(dump, process_state) { }
+
+ExploitabilityRating ExploitabilityLinux::CheckPlatformExploitability() {
+  // Check the crashing thread for functions suggesting a buffer overflow or
+  // stack smash.
+  if (process_state_->requesting_thread() != -1) {
+    CallStack* crashing_thread =
+        process_state_->threads()->at(process_state_->requesting_thread());
+    const vector<StackFrame*>& crashing_thread_frames =
+        *crashing_thread->frames();
+    for (size_t i = 0; i < crashing_thread_frames.size(); ++i) {
+      if (crashing_thread_frames[i]->function_name ==
+          kStackCheckFailureFunction) {
+        return EXPLOITABILITY_HIGH;
+      }
+
+      if (crashing_thread_frames[i]->function_name ==
+          kBoundsCheckFailureFunction) {
+        return EXPLOITABILITY_HIGH;
+      }
+    }
+  }
+
+  return EXPLOITABILITY_NONE;
+}
+
+}  // namespace google_breakpad

src/processor/exploitability_linux.h

@@ -0,0 +1,55 @@
+// Copyright (c) 2013 Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// exploitability_linux.h: Linux specific exploitability engine.
+//
+// Provides a guess at the exploitability of the crash for the Linux
+// platform given a minidump and process_state.
+//
+// Author: Matthew Riley
+
+#ifndef GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_
+#define GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_
+
+#include "google_breakpad/common/breakpad_types.h"
+#include "google_breakpad/processor/exploitability.h"
+
+namespace google_breakpad {
+
+class ExploitabilityLinux : public Exploitability {
+ public:
+  ExploitabilityLinux(Minidump *dump,
+                      ProcessState *process_state);
+
+  virtual ExploitabilityRating CheckPlatformExploitability();
+};
+
+}  // namespace google_breakpad
+
+#endif  // GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_

src/processor/exploitability_unittest.cc

@@ -35,213 +35,83 @@
 #include "breakpad_googletest_includes.h"
 #include "common/using_std_string.h"
 #include "google_breakpad/processor/basic_source_line_resolver.h"
-#include "google_breakpad/processor/call_stack.h"
-#include "google_breakpad/processor/code_module.h"
-#include "google_breakpad/processor/code_modules.h"
-#include "google_breakpad/processor/minidump.h"
 #include "google_breakpad/processor/minidump_processor.h"
 #include "google_breakpad/processor/process_state.h"
-#include "google_breakpad/processor/stack_frame.h"
-#include "google_breakpad/processor/symbol_supplier.h"
-
-namespace google_breakpad {
-class MockMinidump : public Minidump {
- public:
-  MockMinidump() : Minidump("") {
-  }
-
-  MOCK_METHOD0(Read, bool());
-  MOCK_CONST_METHOD0(path, string());
-  MOCK_CONST_METHOD0(header, const MDRawHeader*());
-  MOCK_METHOD0(GetThreadList, MinidumpThreadList*());
-};
-}
+#include "processor/simple_symbol_supplier.h"
 
 namespace {
 
 using google_breakpad::BasicSourceLineResolver;
-using google_breakpad::CallStack;
-using google_breakpad::CodeModule;
 using google_breakpad::MinidumpProcessor;
-using google_breakpad::MinidumpThreadList;
-using google_breakpad::MinidumpThread;
-using google_breakpad::MockMinidump;
 using google_breakpad::ProcessState;
-using google_breakpad::SymbolSupplier;
-using google_breakpad::SystemInfo;
+using google_breakpad::SimpleSymbolSupplier;
 
-class TestSymbolSupplier : public SymbolSupplier {
- public:
-  TestSymbolSupplier() : interrupt_(false) {}
-
-  virtual SymbolResult GetSymbolFile(const CodeModule *module,
-                                     const SystemInfo *system_info,
-                                     string *symbol_file);
-
-  virtual SymbolResult GetSymbolFile(const CodeModule *module,
-                                     const SystemInfo *system_info,
-                                     string *symbol_file,
-                                     string *symbol_data);
-
-  virtual SymbolResult GetCStringSymbolData(const CodeModule *module,
-                                            const SystemInfo *system_info,
-                                            string *symbol_file,
-                                            char **symbol_data,
-                                            size_t *symbol_data_size);
-
-  virtual void FreeSymbolData(const CodeModule *module) { }
-  // When set to true, causes the SymbolSupplier to return INTERRUPT
-  void set_interrupt(bool interrupt) { interrupt_ = interrupt; }
-
- private:
-  bool interrupt_;
-};
-
-SymbolSupplier::SymbolResult TestSymbolSupplier::GetSymbolFile(
-    const CodeModule *module,
-    const SystemInfo *system_info,
-    string *symbol_file) {
-
-  if (interrupt_) {
-    return INTERRUPT;
-  }
-
-  return NOT_FOUND;
+string TestDataDir() {
+  return string(getenv("srcdir") ? getenv("srcdir") : ".") +
+      "/src/processor/testdata";
 }
 
-SymbolSupplier::SymbolResult TestSymbolSupplier::GetCStringSymbolData(
-    const CodeModule *module,
-    const SystemInfo *system_info,
-    string *symbol_file,
-    char **symbol_data,
-    size_t *symbol_data_size) {
-  return GetSymbolFile(module, system_info, symbol_file);
-}
-
-SymbolSupplier::SymbolResult TestSymbolSupplier::GetSymbolFile(
-    const CodeModule *module,
-    const SystemInfo *system_info,
-    string *symbol_file,
-    string *symbol_data) {
-  return GetSymbolFile(module, system_info, symbol_file);
-}
-
-TEST(ExploitabilityTest, TestWindowsEngine) {
-  TestSymbolSupplier supplier;
+// Find the given dump file in <srcdir>/src/processor/testdata, process it,
+// and get the exploitability rating. Returns EXPLOITABILITY_ERR_PROCESSING
+// if the crash dump can't be processed.
+google_breakpad::ExploitabilityRating
+ExploitabilityFor(const string& filename) {
+  SimpleSymbolSupplier supplier(TestDataDir() + "/symbols");
   BasicSourceLineResolver resolver;
   MinidumpProcessor processor(&supplier, &resolver, true);
   ProcessState state;
 
-  string minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
-  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
+  string minidump_file = TestDataDir() + "/" + filename;
 
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_block_write.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
-  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
+  if (processor.Process(minidump_file, &state) !=
+      google_breakpad::PROCESS_OK) {
+    return google_breakpad::EXPLOITABILITY_ERR_PROCESSING;
+  }
 
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_clobber_write.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
-  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
+  return state.exploitability();
+}
 
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_conditional.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+TEST(ExploitabilityTest, TestWindowsEngine) {
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_then_jmp.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_xchg_write.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av_block_write.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_write_av.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av_clobber_write.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_write_av_arg_to_call.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av_conditional.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/null_read_av.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av_then_jmp.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("ascii_read_av_xchg_write.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("ascii_write_av.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("ascii_write_av_arg_to_call.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/null_write_av.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("null_read_av.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/stack_exhaustion.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("null_write_av.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/exec_av_on_stack.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("stack_exhaustion.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/write_av_non_null.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
-  ASSERT_EQ(google_breakpad::EXPLOITABLITY_MEDIUM,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/read_av_non_null.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("exec_av_on_stack.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_MEDIUM,
+            ExploitabilityFor("write_av_non_null.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_LOW,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/read_av_clobber_write.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("read_av_non_null.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_LOW,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/read_av_conditional.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("read_av_clobber_write.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_LOW,
-            state.exploitability());
+            ExploitabilityFor("read_av_conditional.dmp"));
+}
+
+TEST(ExploitabilityTest, TestLinuxEngine) {
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE,
+            ExploitabilityFor("linux_null_read_av.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("linux_overflow.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("linux_stacksmash.dmp"));
 }
 }