1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #include <fcntl.h> 6 #include <stdio.h> 7 #include <stdlib.h> 8 #include <string.h> 9 #include <sys/stat.h> 10 #include <sys/types.h> 11 12 #include <algorithm> 13 #include <limits> 14 15 #include "base/file_util.h" 16 #include "base/logging.h" 17 #include "base/memory/scoped_ptr.h" 18 #include "build/build_config.h" 19 #include "testing/gtest/include/gtest/gtest.h" 20 21 #if defined(OS_POSIX) 22 #include <sys/mman.h> 23 #include <unistd.h> 24 #endif 25 26 using std::nothrow; 27 using std::numeric_limits; 28 29 namespace { 30 31 // This function acts as a compiler optimization barrier. We use it to 32 // prevent the compiler from making an expression a compile-time constant. 33 // We also use it so that the compiler doesn't discard certain return values 34 // as something we don't need (see the comment with calloc below). 35 template <typename Type> 36 Type HideValueFromCompiler(volatile Type value) { 37 #if defined(__GNUC__) 38 // In a GCC compatible compiler (GCC or Clang), make this compiler barrier 39 // more robust than merely using "volatile". 40 __asm__ volatile ("" : "+r" (value)); 41 #endif // __GNUC__ 42 return value; 43 } 44 45 // - NO_TCMALLOC (should be defined if we compile with linux_use_tcmalloc=0) 46 // - ADDRESS_SANITIZER because it has its own memory allocator 47 // - IOS does not use tcmalloc 48 // - OS_MACOSX does not use tcmalloc 49 #if !defined(NO_TCMALLOC) && !defined(ADDRESS_SANITIZER) && \ 50 !defined(OS_IOS) && !defined(OS_MACOSX) 51 #define TCMALLOC_TEST(function) function 52 #else 53 #define TCMALLOC_TEST(function) DISABLED_##function 54 #endif 55 56 // TODO(jln): switch to std::numeric_limits<int>::max() when we switch to 57 // C++11. 58 const size_t kTooBigAllocSize = INT_MAX; 59 60 // Detect runtime TCMalloc bypasses. 61 bool IsTcMallocBypassed() { 62 #if defined(OS_LINUX) || defined(OS_CHROMEOS) 63 // This should detect a TCMalloc bypass from Valgrind. 64 char* g_slice = getenv("G_SLICE"); 65 if (g_slice && !strcmp(g_slice, "always-malloc")) 66 return true; 67 #elif defined(OS_WIN) 68 // This should detect a TCMalloc bypass from setting 69 // the CHROME_ALLOCATOR environment variable. 70 char* allocator = getenv("CHROME_ALLOCATOR"); 71 if (allocator && strcmp(allocator, "tcmalloc")) 72 return true; 73 #endif 74 return false; 75 } 76 77 bool CallocDiesOnOOM() { 78 // The wrapper function in base/process_util_linux.cc that is used when we 79 // compile without TCMalloc will just die on OOM instead of returning NULL. 80 // This function is explicitly disabled if we compile with AddressSanitizer, 81 // MemorySanitizer or ThreadSanitizer. 82 #if defined(OS_LINUX) && defined(NO_TCMALLOC) && \ 83 (!defined(ADDRESS_SANITIZER) && \ 84 !defined(MEMORY_SANITIZER) && \ 85 !defined(THREAD_SANITIZER)) 86 return true; 87 #else 88 return false; 89 #endif 90 } 91 92 // Fake test that allow to know the state of TCMalloc by looking at bots. 93 TEST(SecurityTest, TCMALLOC_TEST(IsTCMallocDynamicallyBypassed)) { 94 printf("Malloc is dynamically bypassed: %s\n", 95 IsTcMallocBypassed() ? "yes." : "no."); 96 } 97 98 // The MemoryAllocationRestrictions* tests test that we can not allocate a 99 // memory range that cannot be indexed via an int. This is used to mitigate 100 // vulnerabilities in libraries that use int instead of size_t. See 101 // crbug.com/169327. 102 103 TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsMalloc)) { 104 if (!IsTcMallocBypassed()) { 105 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( 106 HideValueFromCompiler(malloc(kTooBigAllocSize)))); 107 ASSERT_TRUE(!ptr); 108 } 109 } 110 111 TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsCalloc)) { 112 if (!IsTcMallocBypassed()) { 113 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( 114 HideValueFromCompiler(calloc(kTooBigAllocSize, 1)))); 115 ASSERT_TRUE(!ptr); 116 } 117 } 118 119 TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsRealloc)) { 120 if (!IsTcMallocBypassed()) { 121 char* orig_ptr = static_cast<char*>(malloc(1)); 122 ASSERT_TRUE(orig_ptr); 123 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( 124 HideValueFromCompiler(realloc(orig_ptr, kTooBigAllocSize)))); 125 ASSERT_TRUE(!ptr); 126 // If realloc() did not succeed, we need to free orig_ptr. 127 free(orig_ptr); 128 } 129 } 130 131 typedef struct { 132 char large_array[kTooBigAllocSize]; 133 } VeryLargeStruct; 134 135 TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsNew)) { 136 if (!IsTcMallocBypassed()) { 137 scoped_ptr<VeryLargeStruct> ptr( 138 HideValueFromCompiler(new (nothrow) VeryLargeStruct)); 139 ASSERT_TRUE(!ptr); 140 } 141 } 142 143 TEST(SecurityTest, TCMALLOC_TEST(MemoryAllocationRestrictionsNewArray)) { 144 if (!IsTcMallocBypassed()) { 145 scoped_ptr<char[]> ptr( 146 HideValueFromCompiler(new (nothrow) char[kTooBigAllocSize])); 147 ASSERT_TRUE(!ptr); 148 } 149 } 150 151 // The tests bellow check for overflows in new[] and calloc(). 152 153 #if defined(OS_IOS) || defined(OS_WIN) 154 #define DISABLE_ON_IOS_AND_WIN(function) DISABLED_##function 155 #else 156 #define DISABLE_ON_IOS_AND_WIN(function) function 157 #endif 158 159 // There are platforms where these tests are known to fail. We would like to 160 // be able to easily check the status on the bots, but marking tests as 161 // FAILS_ is too clunky. 162 void OverflowTestsSoftExpectTrue(bool overflow_detected) { 163 if (!overflow_detected) { 164 #if defined(OS_LINUX) || defined(OS_ANDROID) || defined(OS_MACOSX) 165 // Sadly, on Linux, Android, and OSX we don't have a good story yet. Don't 166 // fail the test, but report. 167 printf("Platform has overflow: %s\n", 168 !overflow_detected ? "yes." : "no."); 169 #else 170 // Otherwise, fail the test. (Note: EXPECT are ok in subfunctions, ASSERT 171 // aren't). 172 EXPECT_TRUE(overflow_detected); 173 #endif 174 } 175 } 176 177 // Test array[TooBig][X] and array[X][TooBig] allocations for int overflows. 178 // IOS doesn't honor nothrow, so disable the test there. 179 // Crashes on Windows Dbg builds, disable there as well. 180 TEST(SecurityTest, DISABLE_ON_IOS_AND_WIN(NewOverflow)) { 181 const size_t kArraySize = 4096; 182 // We want something "dynamic" here, so that the compiler doesn't 183 // immediately reject crazy arrays. 184 const size_t kDynamicArraySize = HideValueFromCompiler(kArraySize); 185 // numeric_limits are still not constexpr until we switch to C++11, so we 186 // use an ugly cast. 187 const size_t kMaxSizeT = ~static_cast<size_t>(0); 188 ASSERT_EQ(numeric_limits<size_t>::max(), kMaxSizeT); 189 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; 190 const size_t kDynamicArraySize2 = HideValueFromCompiler(kArraySize2); 191 { 192 scoped_ptr<char[][kArraySize]> array_pointer(new (nothrow) 193 char[kDynamicArraySize2][kArraySize]); 194 OverflowTestsSoftExpectTrue(!array_pointer); 195 } 196 // On windows, the compiler prevents static array sizes of more than 197 // 0x7fffffff (error C2148). 198 #if !defined(OS_WIN) || !defined(ARCH_CPU_64_BITS) 199 { 200 scoped_ptr<char[][kArraySize2]> array_pointer(new (nothrow) 201 char[kDynamicArraySize][kArraySize2]); 202 OverflowTestsSoftExpectTrue(!array_pointer); 203 } 204 #endif // !defined(OS_WIN) || !defined(ARCH_CPU_64_BITS) 205 } 206 207 // Call calloc(), eventually free the memory and return whether or not 208 // calloc() did succeed. 209 bool CallocReturnsNull(size_t nmemb, size_t size) { 210 scoped_ptr<char, base::FreeDeleter> array_pointer( 211 static_cast<char*>(calloc(nmemb, size))); 212 // We need the call to HideValueFromCompiler(): we have seen LLVM 213 // optimize away the call to calloc() entirely and assume 214 // the pointer to not be NULL. 215 return HideValueFromCompiler(array_pointer.get()) == NULL; 216 } 217 218 // Test if calloc() can overflow. 219 TEST(SecurityTest, CallocOverflow) { 220 const size_t kArraySize = 4096; 221 const size_t kMaxSizeT = numeric_limits<size_t>::max(); 222 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; 223 if (!CallocDiesOnOOM()) { 224 EXPECT_TRUE(CallocReturnsNull(kArraySize, kArraySize2)); 225 EXPECT_TRUE(CallocReturnsNull(kArraySize2, kArraySize)); 226 } else { 227 // It's also ok for calloc to just terminate the process. 228 #if defined(GTEST_HAS_DEATH_TEST) 229 EXPECT_DEATH(CallocReturnsNull(kArraySize, kArraySize2), ""); 230 EXPECT_DEATH(CallocReturnsNull(kArraySize2, kArraySize), ""); 231 #endif // GTEST_HAS_DEATH_TEST 232 } 233 } 234 235 #if (defined(OS_LINUX) || defined(OS_CHROMEOS)) && defined(__x86_64__) 236 // Useful for debugging. 237 void PrintProcSelfMaps() { 238 int fd = open("/proc/self/maps", O_RDONLY); 239 file_util::ScopedFD fd_closer(&fd); 240 ASSERT_GE(fd, 0); 241 char buffer[1<<13]; 242 int ret; 243 ret = read(fd, buffer, sizeof(buffer) - 1); 244 ASSERT_GT(ret, 0); 245 buffer[ret - 1] = 0; 246 fprintf(stdout, "%s\n", buffer); 247 } 248 249 // Check if ptr1 and ptr2 are separated by less than size chars. 250 bool ArePointersToSameArea(void* ptr1, void* ptr2, size_t size) { 251 ptrdiff_t ptr_diff = reinterpret_cast<char*>(std::max(ptr1, ptr2)) - 252 reinterpret_cast<char*>(std::min(ptr1, ptr2)); 253 return static_cast<size_t>(ptr_diff) <= size; 254 } 255 256 // Check if TCMalloc uses an underlying random memory allocator. 257 TEST(SecurityTest, TCMALLOC_TEST(RandomMemoryAllocations)) { 258 if (IsTcMallocBypassed()) 259 return; 260 size_t kPageSize = 4096; // We support x86_64 only. 261 // Check that malloc() returns an address that is neither the kernel's 262 // un-hinted mmap area, nor the current brk() area. The first malloc() may 263 // not be at a random address because TCMalloc will first exhaust any memory 264 // that it has allocated early on, before starting the sophisticated 265 // allocators. 266 void* default_mmap_heap_address = 267 mmap(0, kPageSize, PROT_READ|PROT_WRITE, 268 MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); 269 ASSERT_NE(default_mmap_heap_address, 270 static_cast<void*>(MAP_FAILED)); 271 ASSERT_EQ(munmap(default_mmap_heap_address, kPageSize), 0); 272 void* brk_heap_address = sbrk(0); 273 ASSERT_NE(brk_heap_address, reinterpret_cast<void*>(-1)); 274 ASSERT_TRUE(brk_heap_address != NULL); 275 // 1 MB should get us past what TCMalloc pre-allocated before initializing 276 // the sophisticated allocators. 277 size_t kAllocSize = 1<<20; 278 scoped_ptr<char, base::FreeDeleter> ptr( 279 static_cast<char*>(malloc(kAllocSize))); 280 ASSERT_TRUE(ptr != NULL); 281 // If two pointers are separated by less than 512MB, they are considered 282 // to be in the same area. 283 // Our random pointer could be anywhere within 0x3fffffffffff (46bits), 284 // and we are checking that it's not withing 1GB (30 bits) from two 285 // addresses (brk and mmap heap). We have roughly one chance out of 286 // 2^15 to flake. 287 const size_t kAreaRadius = 1<<29; 288 bool in_default_mmap_heap = ArePointersToSameArea( 289 ptr.get(), default_mmap_heap_address, kAreaRadius); 290 EXPECT_FALSE(in_default_mmap_heap); 291 292 bool in_default_brk_heap = ArePointersToSameArea( 293 ptr.get(), brk_heap_address, kAreaRadius); 294 EXPECT_FALSE(in_default_brk_heap); 295 296 // In the implementation, we always mask our random addresses with 297 // kRandomMask, so we use it as an additional detection mechanism. 298 const uintptr_t kRandomMask = 0x3fffffffffffULL; 299 bool impossible_random_address = 300 reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; 301 EXPECT_FALSE(impossible_random_address); 302 } 303 304 #endif // (defined(OS_LINUX) || defined(OS_CHROMEOS)) && defined(__x86_64__) 305 306 } // namespace 307
