1 /* 2 * Copyright (C) 2012 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 /* 30 * Copyright (c) 1988 Regents of the University of California. 31 * All rights reserved. 32 * 33 * Redistribution and use in source and binary forms, with or without 34 * modification, are permitted provided that the following conditions 35 * are met: 36 * 1. Redistributions of source code must retain the above copyright 37 * notice, this list of conditions and the following disclaimer. 38 * 2. Redistributions in binary form must reproduce the above copyright 39 * notice, this list of conditions and the following disclaimer in the 40 * documentation and/or other materials provided with the distribution. 41 * 3. Neither the name of the University nor the names of its contributors 42 * may be used to endorse or promote products derived from this software 43 * without specific prior written permission. 44 * 45 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 48 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 55 * SUCH DAMAGE. 56 */ 57 58 #include <poll.h> 59 #include <stdarg.h> 60 #include <stddef.h> 61 #include <stdio.h> 62 #include <stdlib.h> 63 #include <string.h> 64 #include <sys/cdefs.h> 65 #include <sys/select.h> 66 #include <sys/socket.h> 67 #include <sys/stat.h> 68 #include <unistd.h> 69 70 #include "private/bionic_fortify.h" 71 72 // 73 // For more about FORTIFY see: 74 // 75 // https://android-developers.googleblog.com/2017/04/fortify-in-android.html 76 // 77 // http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html 78 // http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html 79 // 80 81 int __FD_ISSET_chk(int fd, const fd_set* set, size_t set_size) { 82 __check_fd_set("FD_ISSET", fd, set_size); 83 return __FD_ISSET(fd, set); 84 } 85 86 void __FD_CLR_chk(int fd, fd_set* set, size_t set_size) { 87 __check_fd_set("FD_CLR", fd, set_size); 88 __FD_CLR(fd, set); 89 } 90 91 void __FD_SET_chk(int fd, fd_set* set, size_t set_size) { 92 __check_fd_set("FD_SET", fd, set_size); 93 __FD_SET(fd, set); 94 } 95 96 char* __fgets_chk(char* dst, int supplied_size, FILE* stream, size_t dst_len_from_compiler) { 97 if (supplied_size < 0) { 98 __fortify_fatal("fgets: buffer size %d < 0", supplied_size); 99 } 100 __check_buffer_access("fgets", "write into", supplied_size, dst_len_from_compiler); 101 return fgets(dst, supplied_size, stream); 102 } 103 104 size_t __fread_chk(void* buf, size_t size, size_t count, FILE* stream, size_t buf_size) { 105 size_t total; 106 if (__predict_false(__size_mul_overflow(size, count, &total))) { 107 // overflow: trigger the error path in fread 108 return fread(buf, size, count, stream); 109 } 110 __check_buffer_access("fread", "write into", total, buf_size); 111 return fread(buf, size, count, stream); 112 } 113 114 size_t __fwrite_chk(const void* buf, size_t size, size_t count, FILE* stream, size_t buf_size) { 115 size_t total; 116 if (__predict_false(__size_mul_overflow(size, count, &total))) { 117 // overflow: trigger the error path in fwrite 118 return fwrite(buf, size, count, stream); 119 } 120 __check_buffer_access("fwrite", "read from", total, buf_size); 121 return fwrite(buf, size, count, stream); 122 } 123 124 extern char* __getcwd_chk(char* buf, size_t len, size_t actual_size) { 125 __check_buffer_access("getcwd", "write into", len, actual_size); 126 return getcwd(buf, len); 127 } 128 129 void* __memchr_chk(const void* s, int c, size_t n, size_t actual_size) { 130 __check_buffer_access("memchr", "read from", n, actual_size); 131 return const_cast<void*>(memchr(s, c, n)); 132 } 133 134 // Runtime implementation of __builtin____memmove_chk (used directly by compiler, not in headers). 135 extern "C" void* __memmove_chk(void* dst, const void* src, size_t len, size_t dst_len) { 136 __check_buffer_access("memmove", "write into", len, dst_len); 137 return memmove(dst, src, len); 138 } 139 140 // memcpy is performance-critical enough that we have assembler __memcpy_chk implementations. 141 // This function is used to give better diagnostics than we can easily do from assembler. 142 extern "C" void* __memcpy_chk_fail(void* /*dst*/, const void* /*src*/, size_t count, size_t dst_len) { 143 __check_count("memcpy", "count", count); 144 __check_buffer_access("memcpy", "write into", count, dst_len); 145 abort(); // One of the above is supposed to have failed, otherwise we shouldn't have been called. 146 } 147 148 void* __memrchr_chk(const void* s, int c, size_t n, size_t actual_size) { 149 __check_buffer_access("memrchr", "read from", n, actual_size); 150 return memrchr(const_cast<void *>(s), c, n); 151 } 152 153 // memset is performance-critical enough that we have assembler __memset_chk implementations. 154 // This function is used to give better diagnostics than we can easily do from assembler. 155 extern "C" void* __memset_chk_fail(void* /*dst*/, int /*byte*/, size_t count, size_t dst_len) { 156 __check_count("memset", "count", count); 157 __check_buffer_access("memset", "write into", count, dst_len); 158 abort(); // One of the above is supposed to have failed, otherwise we shouldn't have been called. 159 } 160 161 int __poll_chk(pollfd* fds, nfds_t fd_count, int timeout, size_t fds_size) { 162 __check_pollfd_array("poll", fds_size, fd_count); 163 return poll(fds, fd_count, timeout); 164 } 165 166 int __ppoll_chk(pollfd* fds, nfds_t fd_count, const timespec* timeout, 167 const sigset_t* mask, size_t fds_size) { 168 __check_pollfd_array("ppoll", fds_size, fd_count); 169 return ppoll(fds, fd_count, timeout, mask); 170 } 171 172 int __ppoll64_chk(pollfd* fds, nfds_t fd_count, const timespec* timeout, 173 const sigset64_t* mask, size_t fds_size) { 174 __check_pollfd_array("ppoll64", fds_size, fd_count); 175 return ppoll64(fds, fd_count, timeout, mask); 176 } 177 178 ssize_t __pread64_chk(int fd, void* buf, size_t count, off64_t offset, size_t buf_size) { 179 __check_count("pread64", "count", count); 180 __check_buffer_access("pread64", "write into", count, buf_size); 181 return pread64(fd, buf, count, offset); 182 } 183 184 ssize_t __pread_chk(int fd, void* buf, size_t count, off_t offset, size_t buf_size) { 185 __check_count("pread", "count", count); 186 __check_buffer_access("pread", "write into", count, buf_size); 187 return pread(fd, buf, count, offset); 188 } 189 190 ssize_t __pwrite64_chk(int fd, const void* buf, size_t count, off64_t offset, 191 size_t buf_size) { 192 __check_count("pwrite64", "count", count); 193 __check_buffer_access("pwrite64", "read from", count, buf_size); 194 return pwrite64(fd, buf, count, offset); 195 } 196 197 ssize_t __pwrite_chk(int fd, const void* buf, size_t count, off_t offset, 198 size_t buf_size) { 199 __check_count("pwrite", "count", count); 200 __check_buffer_access("pwrite", "read from", count, buf_size); 201 return pwrite(fd, buf, count, offset); 202 } 203 204 ssize_t __read_chk(int fd, void* buf, size_t count, size_t buf_size) { 205 __check_count("read", "count", count); 206 __check_buffer_access("read", "write into", count, buf_size); 207 return read(fd, buf, count); 208 } 209 210 ssize_t __readlinkat_chk(int dirfd, const char* path, char* buf, size_t size, size_t buf_size) { 211 __check_count("readlinkat", "size", size); 212 __check_buffer_access("readlinkat", "write into", size, buf_size); 213 return readlinkat(dirfd, path, buf, size); 214 } 215 216 ssize_t __readlink_chk(const char* path, char* buf, size_t size, size_t buf_size) { 217 __check_count("readlink", "size", size); 218 __check_buffer_access("readlink", "write into", size, buf_size); 219 return readlink(path, buf, size); 220 } 221 222 ssize_t __recvfrom_chk(int socket, void* buf, size_t len, size_t buf_size, 223 int flags, sockaddr* src_addr, socklen_t* addrlen) { 224 __check_buffer_access("recvfrom", "write into", len, buf_size); 225 return recvfrom(socket, buf, len, flags, src_addr, addrlen); 226 } 227 228 ssize_t __sendto_chk(int socket, const void* buf, size_t len, size_t buflen, 229 int flags, const struct sockaddr* dest_addr, 230 socklen_t addrlen) { 231 __check_buffer_access("sendto", "read from", len, buflen); 232 return sendto(socket, buf, len, flags, dest_addr, addrlen); 233 } 234 235 // Runtime implementation of __builtin____stpcpy_chk (used directly by compiler, not in headers).. 236 extern "C" char* __stpcpy_chk(char* dst, const char* src, size_t dst_len) { 237 // TODO: optimize so we don't scan src twice. 238 size_t src_len = strlen(src) + 1; 239 __check_buffer_access("stpcpy", "write into", src_len, dst_len); 240 return stpcpy(dst, src); 241 } 242 243 // Runtime implementation of __builtin____stpncpy_chk (used directly by compiler, not in headers). 244 extern "C" char* __stpncpy_chk(char* dst, const char* src, size_t len, size_t dst_len) { 245 __check_buffer_access("stpncpy", "write into", len, dst_len); 246 return stpncpy(dst, src, len); 247 } 248 249 // This is a variant of __stpncpy_chk, but it also checks to make 250 // sure we don't read beyond the end of "src". The code for this is 251 // based on the original version of stpncpy, but modified to check 252 // how much we read from "src" at the end of the copy operation. 253 char* __stpncpy_chk2(char* dst, const char* src, size_t n, size_t dst_len, size_t src_len) { 254 __check_buffer_access("stpncpy", "write into", n, dst_len); 255 if (n != 0) { 256 char* d = dst; 257 const char* s = src; 258 259 do { 260 if ((*d++ = *s++) == 0) { 261 // NUL pad the remaining n-1 bytes. 262 while (--n != 0) { 263 *d++ = 0; 264 } 265 break; 266 } 267 } while (--n != 0); 268 269 size_t s_copy_len = static_cast<size_t>(s - src); 270 if (__predict_false(s_copy_len > src_len)) { 271 __fortify_fatal("stpncpy: detected read past end of %zu-byte buffer", src_len); 272 } 273 } 274 275 return dst; 276 } 277 278 // strcat is performance-critical enough that we have assembler __strcat_chk implementations. 279 // This function is used to give better diagnostics than we can easily do from assembler. 280 extern "C" void __strcat_chk_fail(size_t dst_buf_size) { 281 __fortify_fatal("strcat: prevented write past end of %zu-byte buffer", dst_buf_size); 282 } 283 284 char* __strchr_chk(const char* p, int ch, size_t s_len) { 285 for (;; ++p, s_len--) { 286 if (__predict_false(s_len == 0)) { 287 __fortify_fatal("strchr: prevented read past end of buffer"); 288 } 289 if (*p == static_cast<char>(ch)) { 290 return const_cast<char*>(p); 291 } 292 if (*p == '\0') { 293 return nullptr; 294 } 295 } 296 } 297 298 // strcpy is performance-critical enough that we have assembler __strcpy_chk implementations. 299 // This function is used to give better diagnostics than we can easily do from assembler. 300 extern "C" void __strcpy_chk_fail(size_t dst_buf_size) { 301 __fortify_fatal("strcpy: prevented write past end of %zu-byte buffer", dst_buf_size); 302 } 303 304 size_t __strlcat_chk(char* dst, const char* src, 305 size_t supplied_size, size_t dst_len_from_compiler) { 306 __check_buffer_access("strlcat", "write into", supplied_size, dst_len_from_compiler); 307 return strlcat(dst, src, supplied_size); 308 } 309 310 size_t __strlcpy_chk(char* dst, const char* src, 311 size_t supplied_size, size_t dst_len_from_compiler) { 312 __check_buffer_access("strlcpy", "write into", supplied_size, dst_len_from_compiler); 313 return strlcpy(dst, src, supplied_size); 314 } 315 316 size_t __strlen_chk(const char* s, size_t s_len) { 317 // TODO: "prevented" here would be a lie because this strlen can run off the end. 318 // strlen is too important to be expensive, so we wanted to be able to call the optimized 319 // implementation, but I think we need to implement optimized assembler __strlen_chk routines. 320 size_t ret = strlen(s); 321 if (__predict_false(ret >= s_len)) { 322 __fortify_fatal("strlen: detected read past end of buffer"); 323 } 324 return ret; 325 } 326 327 // Runtime implementation of __builtin____strncat_chk (used directly by compiler, not in headers). 328 extern "C" char* __strncat_chk(char* dst, const char* src, size_t len, size_t dst_buf_size) { 329 if (len == 0) { 330 return dst; 331 } 332 333 size_t dst_len = __strlen_chk(dst, dst_buf_size); 334 char* d = dst + dst_len; 335 dst_buf_size -= dst_len; 336 337 while (*src != '\0') { 338 *d++ = *src++; 339 len--; dst_buf_size--; 340 341 if (__predict_false(dst_buf_size == 0)) { 342 __fortify_fatal("strncat: prevented write past end of buffer"); 343 } 344 345 if (len == 0) { 346 break; 347 } 348 } 349 350 *d = '\0'; 351 return dst; 352 } 353 354 // Runtime implementation of __builtin____strncpy_chk (used directly by compiler, not in headers). 355 extern "C" char* __strncpy_chk(char* dst, const char* src, size_t len, size_t dst_len) { 356 __check_buffer_access("strncpy", "write into", len, dst_len); 357 return strncpy(dst, src, len); 358 } 359 360 // This is a variant of __strncpy_chk, but it also checks to make 361 // sure we don't read beyond the end of "src". The code for this is 362 // based on the original version of strncpy, but modified to check 363 // how much we read from "src" at the end of the copy operation. 364 char* __strncpy_chk2(char* dst, const char* src, size_t n, size_t dst_len, size_t src_len) { 365 __check_buffer_access("strncpy", "write into", n, dst_len); 366 if (n != 0) { 367 char* d = dst; 368 const char* s = src; 369 370 do { 371 if ((*d++ = *s++) == 0) { 372 // NUL pad the remaining n-1 bytes. 373 while (--n != 0) { 374 *d++ = 0; 375 } 376 break; 377 } 378 } while (--n != 0); 379 380 size_t s_copy_len = static_cast<size_t>(s - src); 381 if (__predict_false(s_copy_len > src_len)) { 382 __fortify_fatal("strncpy: detected read past end of %zu-byte buffer", src_len); 383 } 384 } 385 386 return dst; 387 } 388 389 char* __strrchr_chk(const char* p, int ch, size_t s_len) { 390 for (const char* save = nullptr;; ++p, s_len--) { 391 if (s_len == 0) { 392 __fortify_fatal("strrchr: prevented read past end of buffer"); 393 } 394 if (*p == static_cast<char>(ch)) { 395 save = p; 396 } 397 if (!*p) { 398 return const_cast<char*>(save); 399 } 400 } 401 } 402 403 mode_t __umask_chk(mode_t mode) { 404 if (__predict_false((mode & 0777) != mode)) { 405 __fortify_fatal("umask: called with invalid mask %o", mode); 406 } 407 408 return umask(mode); 409 } 410 411 // Runtime implementation of __builtin____vsnprintf_chk (used directly by compiler, not in headers). 412 extern "C" int __vsnprintf_chk(char* dst, size_t supplied_size, int /*flags*/, 413 size_t dst_len_from_compiler, const char* format, va_list va) { 414 __check_buffer_access("vsnprintf", "write into", supplied_size, dst_len_from_compiler); 415 return vsnprintf(dst, supplied_size, format, va); 416 } 417 418 // Runtime implementation of __builtin____snprintf_chk (used directly by compiler, not in headers). 419 extern "C" int __snprintf_chk(char* dst, size_t supplied_size, int flags, 420 size_t dst_len_from_compiler, const char* format, ...) { 421 va_list va; 422 va_start(va, format); 423 int result = __vsnprintf_chk(dst, supplied_size, flags, dst_len_from_compiler, format, va); 424 va_end(va); 425 return result; 426 } 427 428 // Runtime implementation of __builtin____vsprintf_chk (used directly by compiler, not in headers). 429 extern "C" int __vsprintf_chk(char* dst, int /*flags*/, 430 size_t dst_len_from_compiler, const char* format, va_list va) { 431 // The compiler uses SIZE_MAX to mean "no idea", but our vsnprintf rejects sizes that large. 432 int result = vsnprintf(dst, 433 dst_len_from_compiler == SIZE_MAX ? SSIZE_MAX : dst_len_from_compiler, 434 format, va); 435 436 // Try to catch failures after the fact... 437 __check_buffer_access("vsprintf", "write into", result + 1, dst_len_from_compiler); 438 return result; 439 } 440 441 // Runtime implementation of __builtin____sprintf_chk (used directly by compiler, not in headers). 442 extern "C" int __sprintf_chk(char* dst, int flags, size_t dst_len_from_compiler, 443 const char* format, ...) { 444 va_list va; 445 va_start(va, format); 446 int result = __vsprintf_chk(dst, flags, dst_len_from_compiler, format, va); 447 va_end(va); 448 return result; 449 } 450 451 ssize_t __write_chk(int fd, const void* buf, size_t count, size_t buf_size) { 452 __check_count("write", "count", count); 453 __check_buffer_access("write", "read from", count, buf_size); 454 return write(fd, buf, count); 455 } 456 457 #if defined(RENAME___STRCAT_CHK) 458 #define __STRCAT_CHK __strcat_chk_generic 459 #else 460 #define __STRCAT_CHK __strcat_chk 461 #endif // RENAME___STRCAT_CHK 462 463 // Runtime implementation of __builtin____strcat_chk (used directly by compiler, not in headers). 464 extern "C" char* __STRCAT_CHK(char* dst, const char* src, size_t dst_buf_size) { 465 char* save = dst; 466 size_t dst_len = __strlen_chk(dst, dst_buf_size); 467 468 dst += dst_len; 469 dst_buf_size -= dst_len; 470 471 while ((*dst++ = *src++) != '\0') { 472 dst_buf_size--; 473 if (__predict_false(dst_buf_size == 0)) { 474 __fortify_fatal("strcat: prevented write past end of %zu-byte buffer", dst_buf_size); 475 } 476 } 477 478 return save; 479 } 480 481 #if defined(RENAME___STRCPY_CHK) 482 #define __STRCPY_CHK __strcpy_chk_generic 483 #else 484 #define __STRCPY_CHK __strcpy_chk 485 #endif // RENAME___STRCPY_CHK 486 487 // Runtime implementation of __builtin____strcpy_chk (used directly by compiler, not in headers). 488 extern "C" char* __STRCPY_CHK(char* dst, const char* src, size_t dst_len) { 489 // TODO: optimize so we don't scan src twice. 490 size_t src_len = strlen(src) + 1; 491 __check_buffer_access("strcpy", "write into", src_len, dst_len); 492 return strcpy(dst, src); 493 } 494 495 #if !defined(NO___MEMCPY_CHK) 496 // Runtime implementation of __memcpy_chk (used directly by compiler, not in headers). 497 extern "C" void* __memcpy_chk(void* dst, const void* src, size_t count, size_t dst_len) { 498 __check_count("memcpy", "count", count); 499 __check_buffer_access("memcpy", "write into", count, dst_len); 500 return memcpy(dst, src, count); 501 } 502 #endif // NO___MEMCPY_CHK 503
