From 968c3889223e6a6f948c4eb34a9376cfc1390811 Mon Sep 17 00:00:00 2001 From: Ben Scarlato Date: Sun, 28 Aug 2016 17:11:42 -0700 Subject: [PATCH] Updating ExploitabilityLinux to check memory mapping names against a prefix instead of a specific name. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This will prevent false positives on systems which use a format such as “[stack:69616]” for stack memory mapping names. Change-Id: I51aeda2fe856c1f37f0d18ac06cce69fec2fffa2 Reviewed-on: https://chromium-review.googlesource.com/377086 Reviewed-by: Mike Frysinger --- src/processor/exploitability_linux.cc | 21 +++++++++++------- src/processor/exploitability_unittest.cc | 2 ++ .../linux_stack_pointer_in_stack_alt_name.dmp | Bin 0 -> 38761 bytes 3 files changed, 15 insertions(+), 8 deletions(-) create mode 100644 src/processor/testdata/linux_stack_pointer_in_stack_alt_name.dmp diff --git a/src/processor/exploitability_linux.cc b/src/processor/exploitability_linux.cc index c520059c..63056c43 100644 --- a/src/processor/exploitability_linux.cc +++ b/src/processor/exploitability_linux.cc @@ -54,14 +54,18 @@ namespace { +// Prefixes for memory mapping names. +constexpr char kHeapPrefix[] = "[heap"; +constexpr char kStackPrefix[] = "[stack"; + // This function in libc is called if the program was compiled with // -fstack-protector and a function's stack canary changes. -const char kStackCheckFailureFunction[] = "__stack_chk_fail"; +constexpr char kStackCheckFailureFunction[] = "__stack_chk_fail"; // This function in libc is called if the program was compiled with // -D_FORTIFY_SOURCE=2, a function like strcpy() is called, and the runtime // can determine that the call would overflow the target buffer. -const char kBoundsCheckFailureFunction[] = "__chk_fail"; +constexpr char kBoundsCheckFailureFunction[] = "__chk_fail"; #ifndef _WIN32 const unsigned int MAX_INSTRUCTION_LEN = 15; @@ -539,9 +543,9 @@ bool ExploitabilityLinux::StackPointerOffStack(uint64_t stack_ptr) { // Checks if the stack pointer maps to a valid mapping and if the mapping // is not the stack. If the mapping has no name, it is inconclusive whether // it is off the stack. - return !linux_maps || - (linux_maps->GetPathname().compare("") && - linux_maps->GetPathname().compare("[stack]")); + return !linux_maps || (linux_maps->GetPathname().compare("") && + linux_maps->GetPathname().compare( + 0, strlen(kStackPrefix), kStackPrefix)); } bool ExploitabilityLinux::ExecutableStackOrHeap() { @@ -551,9 +555,10 @@ bool ExploitabilityLinux::ExecutableStackOrHeap() { const MinidumpLinuxMaps *linux_maps = linux_maps_list->GetLinuxMapsAtIndex(i); // Check for executable stack or heap for each mapping. - if (linux_maps && - (!linux_maps->GetPathname().compare("[stack]") || - !linux_maps->GetPathname().compare("[heap]")) && + if (linux_maps && (!linux_maps->GetPathname().compare( + 0, strlen(kStackPrefix), kStackPrefix) || + !linux_maps->GetPathname().compare( + 0, strlen(kHeapPrefix), kHeapPrefix)) && linux_maps->IsExecutable()) { return true; } diff --git a/src/processor/exploitability_unittest.cc b/src/processor/exploitability_unittest.cc index 502edcc7..528ee5f2 100644 --- a/src/processor/exploitability_unittest.cc +++ b/src/processor/exploitability_unittest.cc @@ -161,6 +161,8 @@ TEST(ExploitabilityTest, TestLinuxEngine) { ExploitabilityFor("linux_inside_module_exe_region2.dmp")); ASSERT_EQ(google_breakpad::EXPLOITABILITY_INTERESTING, ExploitabilityFor("linux_stack_pointer_in_stack.dmp")); + ASSERT_EQ(google_breakpad::EXPLOITABILITY_INTERESTING, + ExploitabilityFor("linux_stack_pointer_in_stack_alt_name.dmp")); ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH, ExploitabilityFor("linux_stack_pointer_in_module.dmp")); ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH, diff --git a/src/processor/testdata/linux_stack_pointer_in_stack_alt_name.dmp b/src/processor/testdata/linux_stack_pointer_in_stack_alt_name.dmp new file mode 100644 index 0000000000000000000000000000000000000000..55b34e8a7890f31355dbc0f229b51f9094826a0a GIT binary patch literal 38761 zcmeG_3y>Sdm2G3dt3cRLd<@|;7)Y65Nu%$sQeb!oVw%KKmz1al{mQ^NA8joR|yH^$k|tyTpV(V z?{)Xnq|c=gelJ1#EK(YH!A;1a_tLthfxm*f z`)jmrX`p`vAyJdoEe&)5{a%aKEe(9-0zy6t>D7>yfoA+ZLb@Pb0|ocqPlyB3F9Lr5 zqfiMBNRo9)mRxw!&wuLp-GG(}IR@Y`G~k$LAz260u|UTH+ycM(_&&Eredf&`$!^AB zeQZ7yZ0Y>Ljwm=MJ$7(-#TE`H5RxdbPv@ck4~K+G!nDVZkNsl4JztvnEVHkKiP!2`#5er_Yr zlLPN$cwyg(E#G(1{(s5h@`S#JP`=Rjz^*57oSen35u(4Y!20x>K#y^g^I7pfJb(7e zOIYH-9UQ+O;SJFrF}WY;>0{+pgg;-!@$zb3|8G~^%dSmd{6Oqo6!YER|02Un`1v1> z7g%}sH0Qr+;{)@?^BlHA)Or2yxV`2EpI}{f>^MJYIURX>esyfYfBRK7iCmU z(PskJ3fF$}ai$N7Io`lR+W+iAg?ZB8`U^V<^mUjJb`tor$W2Uc_g0RHVnH;;{fB0w zaAod-^HtYcmxDLvxXC8e&*GopI&%p&74gs%VIYI;!(kVN8 zOd?GySU68eteDoLV`={|=d^#AYC-cHK8OSNMKOSh#L8E~nXOB(-a(`nu$vOVAs`Mf zw#K1-(TnBnFve;TA|R!uNAhK>K+_MRJ=$UULPkae6!o@1J>e^yV)?VMXA0#lWfvXw z7ZAIXweKPjLCrNVGDfbP`tnu#Z#z`_{GCUxz2KYD(aSxJUs2tt99oCc&_mdB4a*U7 zB`~0#9EIO`@VlPuAmo5+?QU|(J|e}}t|W6ic4(^~fC1NXJdo^O0hV61;^~W4NPE|k zul@P>0mnHXA`j37Vw4c68wSbQ=bwA-g?%6$D5FrndsS@Bs@=-E3!|%6IN}dW(cR}= zD4Ii7QN^NU_sZ_?k`=30ef6Vv@$q>Sp%6YN{B)MjzaQEBSvKFSJZJv=@Jlz(+w{7a z=QyYR$agQo-3Sk#&FcyILhe%Zg;}nrpo1CrcbDIF{J6*q`Jea}pPz)j=YQy`dj$=J z!Vr6>xt@&|IK7ysC2aSOd)BbEu;7=xm*=hUkDj4?s2S-&*YEU*?%;O1ZdSnDHP>|AMy0M)4JZ06yA>KV;q02BTB`R{de*Dhgb7F z#Zg91I5CD40mnFwM;W2uCupQP=leWfzaRcS?_XY78(g+=MiSj*jD?c3|UwP$3eD}=V`)Su*n=aimckF$8ZlC0fWWl5b zc3<4bazZYZx!AFkyerY(tFb@DI!*9#?w>y{f|#!%{4~Nt2)~2yKM=l-F!(U%qaoal z@Pi0Hg76^1FC+Xh!plC)>&pmB2xk#~7U8!M{u{!h2vw6LQBTOTlK&T`9Fv8Cx z{2IcaAUykHoZm$VuSa+*!VMVi#p{nF z{0zb$Ap9M|^B&`LQG_Xk4mWK7=vbg*fsO?_7U)=@V}XtZIu__y04?Bh7YuDmHAvrBW;B~jjgD`ROjwp~ zhTU%6s5NHtwQ5l-x$-qbca>_jQdxy`g_pT>B~Lb{;(eQweX)qUZW``#Ew7Z_oX|Z{ ztEld>R#&P8L!EZ#3{{!bl>+G>8p~wjsqElzc6c;4HWZIEv>*Gkyw0F-`G$lolW*-61*+u zgkq@f619MvOLG;}qEatg&~OXH#nYQJqe&rAXcQYvCx`mBN5V3R#|AT_smK(xZXh;{ znh83eX7gXI)^NOVwkalx?duniGfEp%~ z8Xbzbjd~S2K{ebyPoT#WbWf@?hE^>(Z%OxiCw*AU=}G4vuUZ zJrNgoNiT)vu!js}Hn()32Igca-l6G84F*+NnQ@wVqgF2G6eA3sV9hv7)}*siE7Z#> zNkD^7IBEzC64CRCzH~g|A%i37Oy5Xplmgt-jt4!W-qwLGMk*e3^4{a;aw9ZL;czQ%=RSa1rZ%t z&J-B}*grH1sxc49X;pU_6wx(Zm9978Kcg5;#z!J|N{f+@q0s@RtnDgfD9yYf9f>zK zH8wV4jsAvOQVU8>DJgmIprJGv1>7YaG0cb@E@%$U6Un)R&t=_ZZUq$#L5yQ-mA?DWo-_D{E@)t0o` zk~Uh>N?x`3%+`3fQM=@It(oa*>R>dJJM|K)8UXU0y4uW?w4z;*t8mj%B0a}-X6aH( z8rwqgR*829O*dNT8?7`g{4K566sA|3N|;mg(p+uIwbDYQ=lLjN_}Y}Mb)}_gmDZ+J zye&kN&GfX|qHC?CZ57?$nr`wem2L7uGug;DB{ilCHpxtjX8D%Zs+A_a(r9v5s!coBN=Lv#<D%`SaYs)Ua zhTwN;{tXi#Xx_2s5ihE~avYo_iuOb@IEMOEo3rWJd>qHCF zSS??#s8tIrf=kpan8zZ??U}^rNV~CH^vu@{1M0a=%~H9EwON&H$@p7VMs#Vr1=d#f zT9+-A0JA08mxYC5X47bDIFpFOVnxw)P^0eLWd%qoy?vzLUfHJOLxUq@BP|1p@^5H(+OPZ4fTzUfIp-nb=`!EwAE6? z)`g*fpQFYyiEMfl{Dv)>VUg_&sECJyoqby@6o9 zR<0R<9M8l?!5K#)TE&TO(nQ7vQ>{yFHkeg6$qbK;bAeW+-f-e-7T4bEJw7?;53ZLP z8MyCAJaWBE#*(loOl7k1t+0|!M_8-Wg2W)Kf$eg8@n~b{`jM|qP1Ul17M9wIT7h+> z;At=1=if%q`yhT_;6^h#u@l4s9M;!OuN;)Uy<{A2#uB5c!OZp(E|1-=aiwle)C{^39*?n`0eY7NmQ6?8s+D&)3MKk; za!t9v^E(?lZQr=t39+YE+xs`&ck}0+ z0t)u+bmDy&@xImExfAR?D)BtF{rwif=Uw=I2775*AY0&Wc+k4=t(6vnKTr}nY2I;t z+i@Z_=2eEwiRj;o^5g6cAu9a;M*dsTrVh_PP7Cn&GooBMy*V!>!*5Jq`o4v{Y+e5T zu=s9;NfDn~oTSL>f&RtiWbNSZ!isM=DEr2nkd<7n?&mJ%@1yRx#%{&Y<>+myg^70o z>iOmBcJp_L$x)YGS$~h6JgLNbppGtAH;L~j9%#0UL{3VCO?)Gy4lgGQ-x(sZxJnVS z`whyv7G#YtR~O%hB9g5hIl3HulWakX_16jNrqZ$Wop+3`_|T#H)YA_HZ~Ui&A7QU1 z;R6zK7jSixIx&d>uuN(sPZWS|Qi601&Sj!PZUWL3mMRks=oL~W1*oIK+r4i1x`NiL zGm0v)fSa4-SgArLi4N2Sk_Eg9B^H#?ni`pcyn(HvdbWStK#O46Tyc6`o{-C|(R>Vk zR8I}~yGaASkO>0kAbj)cWY{Wb(SURb^sC#H6~K6ji+D%~&L(Ip4k}mv#_+Q{uYPsQ z?q^AGE!f9r@uC@A$$~x9!?S8ef0x;cwFtXs>A%@;BZ{1qWR+Se#Y3 z1(fU*E^7-p{-fL`Dv0Z*BPft#P5Lx3408PbpC9*`u>o0Wu)@Yp#Io1itL zD=f*5DYaUt8Ck6Wxz-jr@_Jn=Diy6f10_KRJX2K5T{P+AX{oAIRLHaTuS?w^jjOdP zh5gAfDIRcof&p2Y@<~z2=L*OJiCKqfsk#pPKTyf*sA%xuG7n54CpWw~CT}<~OGS9R zvh0#&*}rZ9s0zKslj7#i772ROf6TY+e)ma1D>R-w1o0yOeunv z1s#g6u4B?X>HNtH@NDmH+X32fo#g_AU4NmfPDbAXvK!60R++K}{uu6jy2$$+|f zT`E^3*cOCsx~i3>>L^BjB1`wjVFOOm)to8iK!%~}S=f&*NY$ENmKv~k1KW$G8OTD_ zn$ByoTJ$8TbUTN(Rj+E2o-bGG0=pmU@G7y}6WSq}$Zso|x41YD<}p?XcvSAmb2&lX@thJIJG zmImAWlA@YY!&IhJNtps$d4hQ`fdS7KU_WM}m<2m1xe5#n1xx^TR`nbwujyd)GS~vl zP_QQ8r3eW$%EFFXp*Af|RV$iQEUOLO(AXv*RJ5ci9W*VPB{Qe+Ud}3oo$v@i%2hNE zl@G0~Ko>*SD*;DS(yCLmd5&DIRI6w@8;_x0zsuuyh`z>Q9s~@1l%7>!kFH9$&0$;t zQYpYo9?HA*C0^j#`e81!SXOi!GPix=zF6sOJg}(3a_@%@hP zpGm&&KdpTq?wsJBbg}#W-i5y3+wuL5@1IG&A2_XjKd_|ld*p@A54g^5UuU=P4BG7r zp4Q&K^iIEL5$Este&@=6CSCb^PHW#^dZ*vF(D!{E-|zVTndJMur?u}dz0)69==*_= z?{|FvO!EEEY3=(<@AUU9^!=WW?{|FvO!9r$;X0jP?OS@QKeW*KLmlVuIR6>t{C}M9 z_IXdyd%er-^)I&F=jphA$Nf)t_a|fo-p3Dj@vo^IX$!vF2zOc1IvSG=-j0Vz4K@7+ zN2a6|!d+fD;FTRCEG;{dO;nPlSp5qr*AWRWcYc5QYaLX0gkaKL8;g43HhX6pX~Qaj;)m>#J>x7Ns{F8hk$-^BjC8)`M9AxCj+b` zbFw5vI-xb`fvCi`VUF^69O;R| z5(QdmV;Pj4NA6d9DXYN}m}Fi7WN1Nu$+8PP5bQ^mX^nnGAFNK;1$ISRkTfcb7sQLj z#S1nz+uAJx}SaM_B zA|4LNhcSFuTn-u((yiBZU9~8hg#mGc0pJ4*H;?fL5q01T1h=JDAkGF2IaD@tPD3rL zfOV-x?plv@odW_UW>SM2A);L@&f?%%27Ie9W8)zVNq=fEnV}I=){ZeL;6X0gFG0M< zwKf^V>fnVoCKVrwvyg$5*fB6VIxrMpAO+D-djOjtC`I+PT$oq(1ms{Q=3Q$Oj6xhr zj3pv)nN%M{%YpA%a%Gj7k+cWs=tSD=MB3~`+7v-FApmM8(q<>pCW{c-iL~jXksv#f zHan3vJCQa!kv89O_|8tGO&(Rg6KT^9zuAej*@?8-iL|-wpQkusq)iM^a*YU7()oLR z?C&n0=14+qnHgrjBVM)b&m~Nr^dILd-pu+bc7d^Lxs^*(f?SEio zsUE~VXITz6yZsamHt;_OjYAw)--vbSZ;>#v-8s%16%3mVC+CMFP&1U3|Y%Z-jSLb;x0JJ{=A)ZLeK$YuyW zA&l`yVLm#k*gY&a=UMKNZ(11VZwuos6LV>s`=0_~ls^jd2l#xs;8F%H3-pG10)a*S zg#9UkCFZvFsDfxvE(yg318iua%g8Frq05|Fv0RcZmW^Tb9$9TQ?Wq<^B?+;#dG^F7 zs|A{SYg)@B39&t_eare(kkN<=y=b2Hb&a_2^e#FWmb%Ebg>%Gl5M)A7Vs9_Ag%}4O zddU@*VVBiYA(0EQCC(cH?7`|=AhD(QdwYwmz5iCVkqQxQ4Eb6mLK>{vHktM^8c`v~ z9B|=+mUp}-)N>LYZ^zHX4p-psLD;G(p?M3%MO9OjmbNIl6AxlegKbenTli9xz6{km zq~2s(7;{_FytO7Q0#B(V%G{Q;yw!@uTv5(Z=Ya|=Q(y~&#a;hac&rPrW&}fUA3+zp zw1TIXO2FElUS50NML~?8g(JZs-Uuib+4LhjTM>&~rk7-O>l8*z4e{0g46_5RiGkF%iIA6*$`C1+!Kql@Ry!TjNs zJTE-*oA{SWL|oxDNOv*91G~6iU^Bo#Tt7R~Ix@Zp>CZ)YDZ*rTl%)jz-~~J{?0pdF jx)2Kazdz2~^Wxh%J^WP*);{rvRE}akhUHk@29Ey)QSy-~ literal 0 HcmV?d00001