1 /* 2 * Copyright (C) 2012 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 /* 30 * Copyright (c) 1988 Regents of the University of California. 31 * All rights reserved. 32 * 33 * Redistribution and use in source and binary forms, with or without 34 * modification, are permitted provided that the following conditions 35 * are met: 36 * 1. Redistributions of source code must retain the above copyright 37 * notice, this list of conditions and the following disclaimer. 38 * 2. Redistributions in binary form must reproduce the above copyright 39 * notice, this list of conditions and the following disclaimer in the 40 * documentation and/or other materials provided with the distribution. 41 * 3. Neither the name of the University nor the names of its contributors 42 * may be used to endorse or promote products derived from this software 43 * without specific prior written permission. 44 * 45 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 48 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 55 * SUCH DAMAGE. 56 */ 57 58 #undef _FORTIFY_SOURCE 59 60 #include <poll.h> 61 #include <stdarg.h> 62 #include <stddef.h> 63 #include <stdio.h> 64 #include <stdlib.h> 65 #include <string.h> 66 #include <sys/cdefs.h> 67 #include <sys/select.h> 68 #include <sys/socket.h> 69 #include <sys/stat.h> 70 #include <unistd.h> 71 72 #include "private/bionic_fortify.h" 73 74 struct __bionic_zero_size_is_okay_t __bionic_zero_size_is_okay; 75 76 // 77 // For more details see: 78 // http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html 79 // http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html 80 // 81 // TODO: add a link to similar clang documentation? 82 // 83 84 int __FD_ISSET_chk(int fd, fd_set* set, size_t set_size) { 85 __check_fd_set("FD_ISSET", fd, set_size); 86 return FD_ISSET(fd, set); 87 } 88 89 void __FD_CLR_chk(int fd, fd_set* set, size_t set_size) { 90 __check_fd_set("FD_CLR", fd, set_size); 91 FD_CLR(fd, set); 92 } 93 94 void __FD_SET_chk(int fd, fd_set* set, size_t set_size) { 95 __check_fd_set("FD_SET", fd, set_size); 96 FD_SET(fd, set); 97 } 98 99 char* __fgets_chk(char* dst, int supplied_size, FILE* stream, size_t dst_len_from_compiler) { 100 if (supplied_size < 0) { 101 __fortify_fatal("fgets: buffer size %d < 0", supplied_size); 102 } 103 __check_buffer_access("fgets", "write into", supplied_size, dst_len_from_compiler); 104 return fgets(dst, supplied_size, stream); 105 } 106 107 size_t __fread_chk(void* __restrict buf, size_t size, size_t count, 108 FILE* __restrict stream, size_t buf_size) { 109 size_t total; 110 if (__predict_false(__size_mul_overflow(size, count, &total))) { 111 // overflow: trigger the error path in fread 112 return fread(buf, size, count, stream); 113 } 114 __check_buffer_access("fread", "write into", total, buf_size); 115 return fread(buf, size, count, stream); 116 } 117 118 size_t __fwrite_chk(const void* __restrict buf, size_t size, size_t count, 119 FILE* __restrict stream, size_t buf_size) { 120 size_t total; 121 if (__predict_false(__size_mul_overflow(size, count, &total))) { 122 // overflow: trigger the error path in fwrite 123 return fwrite(buf, size, count, stream); 124 } 125 __check_buffer_access("fwrite", "read from", total, buf_size); 126 return fwrite(buf, size, count, stream); 127 } 128 129 extern char* __getcwd_chk(char* buf, size_t len, size_t actual_size) { 130 __check_buffer_access("getcwd", "write into", len, actual_size); 131 return getcwd(buf, len); 132 } 133 134 void* __memchr_chk(const void* s, int c, size_t n, size_t actual_size) { 135 __check_buffer_access("memchr", "read from", n, actual_size); 136 return memchr(s, c, n); 137 } 138 139 // Runtime implementation of __builtin____memmove_chk (used directly by compiler, not in headers). 140 extern "C" void* __memmove_chk(void* dst, const void* src, size_t len, size_t dst_len) { 141 __check_buffer_access("memmove", "write into", len, dst_len); 142 return memmove(dst, src, len); 143 } 144 145 // memcpy is performance-critical enough that we have assembler __memcpy_chk implementations. 146 // This function is used to give better diagnostics than we can easily do from assembler. 147 extern "C" void* __memcpy_chk_fail(void* /*dst*/, const void* /*src*/, size_t count, size_t dst_len) { 148 __check_count("memcpy", "count", count); 149 __check_buffer_access("memcpy", "write into", count, dst_len); 150 abort(); // One of the above is supposed to have failed, otherwise we shouldn't have been called. 151 } 152 153 void* __memrchr_chk(const void* s, int c, size_t n, size_t actual_size) { 154 __check_buffer_access("memrchr", "read from", n, actual_size); 155 return memrchr(s, c, n); 156 } 157 158 // memset is performance-critical enough that we have assembler __memset_chk implementations. 159 // This function is used to give better diagnostics than we can easily do from assembler. 160 extern "C" void* __memset_chk_fail(void* /*dst*/, int /*byte*/, size_t count, size_t dst_len) { 161 __check_count("memset", "count", count); 162 __check_buffer_access("memset", "write into", count, dst_len); 163 abort(); // One of the above is supposed to have failed, otherwise we shouldn't have been called. 164 } 165 166 int __poll_chk(pollfd* fds, nfds_t fd_count, int timeout, size_t fds_size) { 167 __check_pollfd_array("poll", fds_size, fd_count); 168 return poll(fds, fd_count, timeout); 169 } 170 171 int __ppoll_chk(pollfd* fds, nfds_t fd_count, const timespec* timeout, 172 const sigset_t* mask, size_t fds_size) { 173 __check_pollfd_array("ppoll", fds_size, fd_count); 174 return ppoll(fds, fd_count, timeout, mask); 175 } 176 177 ssize_t __pread64_chk(int fd, void* buf, size_t count, off64_t offset, size_t buf_size) { 178 __check_count("pread64", "count", count); 179 __check_buffer_access("pread64", "write into", count, buf_size); 180 return pread64(fd, buf, count, offset); 181 } 182 183 ssize_t __pread_chk(int fd, void* buf, size_t count, off_t offset, size_t buf_size) { 184 __check_count("pread", "count", count); 185 __check_buffer_access("pread", "write into", count, buf_size); 186 return pread(fd, buf, count, offset); 187 } 188 189 ssize_t __pwrite64_chk(int fd, const void* buf, size_t count, off64_t offset, 190 size_t buf_size) { 191 __check_count("pwrite64", "count", count); 192 __check_buffer_access("pwrite64", "read from", count, buf_size); 193 return pwrite64(fd, buf, count, offset); 194 } 195 196 ssize_t __pwrite_chk(int fd, const void* buf, size_t count, off_t offset, 197 size_t buf_size) { 198 __check_count("pwrite", "count", count); 199 __check_buffer_access("pwrite", "read from", count, buf_size); 200 return pwrite(fd, buf, count, offset); 201 } 202 203 ssize_t __read_chk(int fd, void* buf, size_t count, size_t buf_size) { 204 __check_count("read", "count", count); 205 __check_buffer_access("read", "write into", count, buf_size); 206 return read(fd, buf, count); 207 } 208 209 ssize_t __readlinkat_chk(int dirfd, const char* path, char* buf, size_t size, size_t buf_size) { 210 __check_count("readlinkat", "size", size); 211 __check_buffer_access("readlinkat", "write into", size, buf_size); 212 return readlinkat(dirfd, path, buf, size); 213 } 214 215 ssize_t __readlink_chk(const char* path, char* buf, size_t size, size_t buf_size) { 216 __check_count("readlink", "size", size); 217 __check_buffer_access("readlink", "write into", size, buf_size); 218 return readlink(path, buf, size); 219 } 220 221 ssize_t __recvfrom_chk(int socket, void* buf, size_t len, size_t buf_size, 222 int flags, sockaddr* src_addr, socklen_t* addrlen) { 223 __check_buffer_access("recvfrom", "write into", len, buf_size); 224 return recvfrom(socket, buf, len, flags, src_addr, addrlen); 225 } 226 227 ssize_t __sendto_chk(int socket, const void* buf, size_t len, size_t buflen, 228 int flags, const struct sockaddr* dest_addr, 229 socklen_t addrlen) { 230 __check_buffer_access("sendto", "read from", len, buflen); 231 return sendto(socket, buf, len, flags, dest_addr, addrlen); 232 } 233 234 // Runtime implementation of __builtin____stpcpy_chk (used directly by compiler, not in headers).. 235 extern "C" char* __stpcpy_chk(char* dst, const char* src, size_t dst_len) { 236 // TODO: optimize so we don't scan src twice. 237 size_t src_len = strlen(src) + 1; 238 __check_buffer_access("stpcpy", "write into", src_len, dst_len); 239 return stpcpy(dst, src); 240 } 241 242 // Runtime implementation of __builtin____stpncpy_chk (used directly by compiler, not in headers). 243 extern "C" char* __stpncpy_chk(char* __restrict dst, const char* __restrict src, 244 size_t len, size_t dst_len) { 245 __check_buffer_access("stpncpy", "write into", len, dst_len); 246 return stpncpy(dst, src, len); 247 } 248 249 // This is a variant of __stpncpy_chk, but it also checks to make 250 // sure we don't read beyond the end of "src". The code for this is 251 // based on the original version of stpncpy, but modified to check 252 // how much we read from "src" at the end of the copy operation. 253 char* __stpncpy_chk2(char* __restrict dst, const char* __restrict src, 254 size_t n, size_t dst_len, size_t src_len) { 255 __check_buffer_access("stpncpy", "write into", n, dst_len); 256 if (n != 0) { 257 char* d = dst; 258 const char* s = src; 259 260 do { 261 if ((*d++ = *s++) == 0) { 262 // NUL pad the remaining n-1 bytes. 263 while (--n != 0) { 264 *d++ = 0; 265 } 266 break; 267 } 268 } while (--n != 0); 269 270 size_t s_copy_len = static_cast<size_t>(s - src); 271 if (__predict_false(s_copy_len > src_len)) { 272 __fortify_fatal("stpncpy: detected read past end of %zu-byte buffer", src_len); 273 } 274 } 275 276 return dst; 277 } 278 279 // strcat is performance-critical enough that we have assembler __strcat_chk implementations. 280 // This function is used to give better diagnostics than we can easily do from assembler. 281 extern "C" void __strcat_chk_fail(size_t dst_buf_size) { 282 __fortify_fatal("strcat: prevented write past end of %zu-byte buffer", dst_buf_size); 283 } 284 285 char* __strchr_chk(const char* p, int ch, size_t s_len) { 286 for (;; ++p, s_len--) { 287 if (__predict_false(s_len == 0)) { 288 __fortify_fatal("strchr: prevented read past end of buffer"); 289 } 290 if (*p == static_cast<char>(ch)) { 291 return const_cast<char*>(p); 292 } 293 if (*p == '\0') { 294 return NULL; 295 } 296 } 297 } 298 299 // strcpy is performance-critical enough that we have assembler __strcpy_chk implementations. 300 // This function is used to give better diagnostics than we can easily do from assembler. 301 extern "C" void __strcpy_chk_fail(size_t dst_buf_size) { 302 __fortify_fatal("strcpy: prevented write past end of %zu-byte buffer", dst_buf_size); 303 } 304 305 size_t __strlcat_chk(char* dst, const char* src, 306 size_t supplied_size, size_t dst_len_from_compiler) { 307 __check_buffer_access("strlcat", "write into", supplied_size, dst_len_from_compiler); 308 return strlcat(dst, src, supplied_size); 309 } 310 311 size_t __strlcpy_chk(char* dst, const char* src, 312 size_t supplied_size, size_t dst_len_from_compiler) { 313 __check_buffer_access("strlcpy", "write into", supplied_size, dst_len_from_compiler); 314 return strlcpy(dst, src, supplied_size); 315 } 316 317 size_t __strlen_chk(const char* s, size_t s_len) { 318 // TODO: "prevented" here would be a lie because this strlen can run off the end. 319 // strlen is too important to be expensive, so we wanted to be able to call the optimized 320 // implementation, but I think we need to implement optimized assembler __strlen_chk routines. 321 size_t ret = strlen(s); 322 if (__predict_false(ret >= s_len)) { 323 __fortify_fatal("strlen: detected read past end of buffer"); 324 } 325 return ret; 326 } 327 328 // Runtime implementation of __builtin____strncat_chk (used directly by compiler, not in headers). 329 extern "C" char* __strncat_chk(char* __restrict dst, const char* __restrict src, 330 size_t len, size_t dst_buf_size) { 331 if (len == 0) { 332 return dst; 333 } 334 335 size_t dst_len = __strlen_chk(dst, dst_buf_size); 336 char* d = dst + dst_len; 337 dst_buf_size -= dst_len; 338 339 while (*src != '\0') { 340 *d++ = *src++; 341 len--; dst_buf_size--; 342 343 if (__predict_false(dst_buf_size == 0)) { 344 __fortify_fatal("strncat: prevented write past end of buffer"); 345 } 346 347 if (len == 0) { 348 break; 349 } 350 } 351 352 *d = '\0'; 353 return dst; 354 } 355 356 // Runtime implementation of __builtin____strncpy_chk (used directly by compiler, not in headers). 357 extern "C" char* __strncpy_chk(char* __restrict dst, const char* __restrict src, 358 size_t len, size_t dst_len) { 359 __check_buffer_access("strncpy", "write into", len, dst_len); 360 return strncpy(dst, src, len); 361 } 362 363 // This is a variant of __strncpy_chk, but it also checks to make 364 // sure we don't read beyond the end of "src". The code for this is 365 // based on the original version of strncpy, but modified to check 366 // how much we read from "src" at the end of the copy operation. 367 char* __strncpy_chk2(char* __restrict dst, const char* __restrict src, 368 size_t n, size_t dst_len, size_t src_len) { 369 __check_buffer_access("strncpy", "write into", n, dst_len); 370 if (n != 0) { 371 char* d = dst; 372 const char* s = src; 373 374 do { 375 if ((*d++ = *s++) == 0) { 376 // NUL pad the remaining n-1 bytes. 377 while (--n != 0) { 378 *d++ = 0; 379 } 380 break; 381 } 382 } while (--n != 0); 383 384 size_t s_copy_len = static_cast<size_t>(s - src); 385 if (__predict_false(s_copy_len > src_len)) { 386 __fortify_fatal("strncpy: detected read past end of %zu-byte buffer", src_len); 387 } 388 } 389 390 return dst; 391 } 392 393 char* __strrchr_chk(const char* p, int ch, size_t s_len) { 394 for (const char* save = NULL;; ++p, s_len--) { 395 if (s_len == 0) { 396 __fortify_fatal("strrchr: prevented read past end of buffer"); 397 } 398 if (*p == static_cast<char>(ch)) { 399 save = p; 400 } 401 if (!*p) { 402 return const_cast<char*>(save); 403 } 404 } 405 } 406 407 mode_t __umask_chk(mode_t mode) { 408 if (__predict_false((mode & 0777) != mode)) { 409 __fortify_fatal("umask: called with invalid mask %o", mode); 410 } 411 412 return umask(mode); 413 } 414 415 // Runtime implementation of __builtin____vsnprintf_chk (used directly by compiler, not in headers). 416 extern "C" int __vsnprintf_chk(char* dst, size_t supplied_size, int /*flags*/, 417 size_t dst_len_from_compiler, const char* format, va_list va) { 418 __check_buffer_access("vsnprintf", "write into", supplied_size, dst_len_from_compiler); 419 return vsnprintf(dst, supplied_size, format, va); 420 } 421 422 // Runtime implementation of __builtin____snprintf_chk (used directly by compiler, not in headers). 423 extern "C" int __snprintf_chk(char* dst, size_t supplied_size, int flags, 424 size_t dst_len_from_compiler, const char* format, ...) { 425 va_list va; 426 va_start(va, format); 427 int result = __vsnprintf_chk(dst, supplied_size, flags, dst_len_from_compiler, format, va); 428 va_end(va); 429 return result; 430 } 431 432 // Runtime implementation of __builtin____vsprintf_chk (used directly by compiler, not in headers). 433 extern "C" int __vsprintf_chk(char* dst, int /*flags*/, 434 size_t dst_len_from_compiler, const char* format, va_list va) { 435 // The compiler uses SIZE_MAX to mean "no idea", but our vsnprintf rejects sizes that large. 436 int result = vsnprintf(dst, 437 dst_len_from_compiler == SIZE_MAX ? SSIZE_MAX : dst_len_from_compiler, 438 format, va); 439 440 // Try to catch failures after the fact... 441 __check_buffer_access("vsprintf", "write into", result + 1, dst_len_from_compiler); 442 return result; 443 } 444 445 // Runtime implementation of __builtin____sprintf_chk (used directly by compiler, not in headers). 446 extern "C" int __sprintf_chk(char* dst, int flags, size_t dst_len_from_compiler, 447 const char* format, ...) { 448 va_list va; 449 va_start(va, format); 450 int result = __vsprintf_chk(dst, flags, dst_len_from_compiler, format, va); 451 va_end(va); 452 return result; 453 } 454 455 ssize_t __write_chk(int fd, const void* buf, size_t count, size_t buf_size) { 456 __check_count("write", "count", count); 457 __check_buffer_access("write", "read from", count, buf_size); 458 return write(fd, buf, count); 459 } 460
