1 /* 2 * Copyright (C) 2012 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 /* 30 * Copyright (c) 1988 Regents of the University of California. 31 * All rights reserved. 32 * 33 * Redistribution and use in source and binary forms, with or without 34 * modification, are permitted provided that the following conditions 35 * are met: 36 * 1. Redistributions of source code must retain the above copyright 37 * notice, this list of conditions and the following disclaimer. 38 * 2. Redistributions in binary form must reproduce the above copyright 39 * notice, this list of conditions and the following disclaimer in the 40 * documentation and/or other materials provided with the distribution. 41 * 3. Neither the name of the University nor the names of its contributors 42 * may be used to endorse or promote products derived from this software 43 * without specific prior written permission. 44 * 45 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 48 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 55 * SUCH DAMAGE. 56 */ 57 58 #include <poll.h> 59 #include <stdarg.h> 60 #include <stddef.h> 61 #include <stdio.h> 62 #include <stdlib.h> 63 #include <string.h> 64 #include <sys/cdefs.h> 65 #include <sys/select.h> 66 #include <sys/socket.h> 67 #include <sys/stat.h> 68 #include <unistd.h> 69 70 #include "private/bionic_fortify.h" 71 72 // 73 // For more about FORTIFY see: 74 // 75 // https://android-developers.googleblog.com/2017/04/fortify-in-android.html 76 // 77 // http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html 78 // http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html 79 // 80 81 int __FD_ISSET_chk(int fd, const fd_set* set, size_t set_size) { 82 __check_fd_set("FD_ISSET", fd, set_size); 83 return __FD_ISSET(fd, set); 84 } 85 86 void __FD_CLR_chk(int fd, fd_set* set, size_t set_size) { 87 __check_fd_set("FD_CLR", fd, set_size); 88 __FD_CLR(fd, set); 89 } 90 91 void __FD_SET_chk(int fd, fd_set* set, size_t set_size) { 92 __check_fd_set("FD_SET", fd, set_size); 93 __FD_SET(fd, set); 94 } 95 96 char* __fgets_chk(char* dst, int supplied_size, FILE* stream, size_t dst_len_from_compiler) { 97 if (supplied_size < 0) { 98 __fortify_fatal("fgets: buffer size %d < 0", supplied_size); 99 } 100 __check_buffer_access("fgets", "write into", supplied_size, dst_len_from_compiler); 101 return fgets(dst, supplied_size, stream); 102 } 103 104 size_t __fread_chk(void* buf, size_t size, size_t count, FILE* stream, size_t buf_size) { 105 size_t total; 106 if (__predict_false(__size_mul_overflow(size, count, &total))) { 107 // overflow: trigger the error path in fread 108 return fread(buf, size, count, stream); 109 } 110 __check_buffer_access("fread", "write into", total, buf_size); 111 return fread(buf, size, count, stream); 112 } 113 114 size_t __fwrite_chk(const void* buf, size_t size, size_t count, FILE* stream, size_t buf_size) { 115 size_t total; 116 if (__predict_false(__size_mul_overflow(size, count, &total))) { 117 // overflow: trigger the error path in fwrite 118 return fwrite(buf, size, count, stream); 119 } 120 __check_buffer_access("fwrite", "read from", total, buf_size); 121 return fwrite(buf, size, count, stream); 122 } 123 124 extern char* __getcwd_chk(char* buf, size_t len, size_t actual_size) { 125 __check_buffer_access("getcwd", "write into", len, actual_size); 126 return getcwd(buf, len); 127 } 128 129 void* __memchr_chk(const void* s, int c, size_t n, size_t actual_size) { 130 __check_buffer_access("memchr", "read from", n, actual_size); 131 return const_cast<void*>(memchr(s, c, n)); 132 } 133 134 // Runtime implementation of __builtin____memmove_chk (used directly by compiler, not in headers). 135 extern "C" void* __memmove_chk(void* dst, const void* src, size_t len, size_t dst_len) { 136 __check_buffer_access("memmove", "write into", len, dst_len); 137 return memmove(dst, src, len); 138 } 139 140 // memcpy is performance-critical enough that we have assembler __memcpy_chk implementations. 141 // This function is used to give better diagnostics than we can easily do from assembler. 142 extern "C" void* __memcpy_chk_fail(void* /*dst*/, const void* /*src*/, size_t count, size_t dst_len) { 143 __check_count("memcpy", "count", count); 144 __check_buffer_access("memcpy", "write into", count, dst_len); 145 abort(); // One of the above is supposed to have failed, otherwise we shouldn't have been called. 146 } 147 148 void* __memrchr_chk(const void* s, int c, size_t n, size_t actual_size) { 149 __check_buffer_access("memrchr", "read from", n, actual_size); 150 return memrchr(const_cast<void *>(s), c, n); 151 } 152 153 // memset is performance-critical enough that we have assembler __memset_chk implementations. 154 // This function is used to give better diagnostics than we can easily do from assembler. 155 extern "C" void* __memset_chk_fail(void* /*dst*/, int /*byte*/, size_t count, size_t dst_len) { 156 __check_count("memset", "count", count); 157 __check_buffer_access("memset", "write into", count, dst_len); 158 abort(); // One of the above is supposed to have failed, otherwise we shouldn't have been called. 159 } 160 161 int __poll_chk(pollfd* fds, nfds_t fd_count, int timeout, size_t fds_size) { 162 __check_pollfd_array("poll", fds_size, fd_count); 163 return poll(fds, fd_count, timeout); 164 } 165 166 int __ppoll_chk(pollfd* fds, nfds_t fd_count, const timespec* timeout, 167 const sigset_t* mask, size_t fds_size) { 168 __check_pollfd_array("ppoll", fds_size, fd_count); 169 return ppoll(fds, fd_count, timeout, mask); 170 } 171 172 ssize_t __pread64_chk(int fd, void* buf, size_t count, off64_t offset, size_t buf_size) { 173 __check_count("pread64", "count", count); 174 __check_buffer_access("pread64", "write into", count, buf_size); 175 return pread64(fd, buf, count, offset); 176 } 177 178 ssize_t __pread_chk(int fd, void* buf, size_t count, off_t offset, size_t buf_size) { 179 __check_count("pread", "count", count); 180 __check_buffer_access("pread", "write into", count, buf_size); 181 return pread(fd, buf, count, offset); 182 } 183 184 ssize_t __pwrite64_chk(int fd, const void* buf, size_t count, off64_t offset, 185 size_t buf_size) { 186 __check_count("pwrite64", "count", count); 187 __check_buffer_access("pwrite64", "read from", count, buf_size); 188 return pwrite64(fd, buf, count, offset); 189 } 190 191 ssize_t __pwrite_chk(int fd, const void* buf, size_t count, off_t offset, 192 size_t buf_size) { 193 __check_count("pwrite", "count", count); 194 __check_buffer_access("pwrite", "read from", count, buf_size); 195 return pwrite(fd, buf, count, offset); 196 } 197 198 ssize_t __read_chk(int fd, void* buf, size_t count, size_t buf_size) { 199 __check_count("read", "count", count); 200 __check_buffer_access("read", "write into", count, buf_size); 201 return read(fd, buf, count); 202 } 203 204 ssize_t __readlinkat_chk(int dirfd, const char* path, char* buf, size_t size, size_t buf_size) { 205 __check_count("readlinkat", "size", size); 206 __check_buffer_access("readlinkat", "write into", size, buf_size); 207 return readlinkat(dirfd, path, buf, size); 208 } 209 210 ssize_t __readlink_chk(const char* path, char* buf, size_t size, size_t buf_size) { 211 __check_count("readlink", "size", size); 212 __check_buffer_access("readlink", "write into", size, buf_size); 213 return readlink(path, buf, size); 214 } 215 216 ssize_t __recvfrom_chk(int socket, void* buf, size_t len, size_t buf_size, 217 int flags, sockaddr* src_addr, socklen_t* addrlen) { 218 __check_buffer_access("recvfrom", "write into", len, buf_size); 219 return recvfrom(socket, buf, len, flags, src_addr, addrlen); 220 } 221 222 ssize_t __sendto_chk(int socket, const void* buf, size_t len, size_t buflen, 223 int flags, const struct sockaddr* dest_addr, 224 socklen_t addrlen) { 225 __check_buffer_access("sendto", "read from", len, buflen); 226 return sendto(socket, buf, len, flags, dest_addr, addrlen); 227 } 228 229 // Runtime implementation of __builtin____stpcpy_chk (used directly by compiler, not in headers).. 230 extern "C" char* __stpcpy_chk(char* dst, const char* src, size_t dst_len) { 231 // TODO: optimize so we don't scan src twice. 232 size_t src_len = strlen(src) + 1; 233 __check_buffer_access("stpcpy", "write into", src_len, dst_len); 234 return stpcpy(dst, src); 235 } 236 237 // Runtime implementation of __builtin____stpncpy_chk (used directly by compiler, not in headers). 238 extern "C" char* __stpncpy_chk(char* dst, const char* src, size_t len, size_t dst_len) { 239 __check_buffer_access("stpncpy", "write into", len, dst_len); 240 return stpncpy(dst, src, len); 241 } 242 243 // This is a variant of __stpncpy_chk, but it also checks to make 244 // sure we don't read beyond the end of "src". The code for this is 245 // based on the original version of stpncpy, but modified to check 246 // how much we read from "src" at the end of the copy operation. 247 char* __stpncpy_chk2(char* dst, const char* src, size_t n, size_t dst_len, size_t src_len) { 248 __check_buffer_access("stpncpy", "write into", n, dst_len); 249 if (n != 0) { 250 char* d = dst; 251 const char* s = src; 252 253 do { 254 if ((*d++ = *s++) == 0) { 255 // NUL pad the remaining n-1 bytes. 256 while (--n != 0) { 257 *d++ = 0; 258 } 259 break; 260 } 261 } while (--n != 0); 262 263 size_t s_copy_len = static_cast<size_t>(s - src); 264 if (__predict_false(s_copy_len > src_len)) { 265 __fortify_fatal("stpncpy: detected read past end of %zu-byte buffer", src_len); 266 } 267 } 268 269 return dst; 270 } 271 272 // strcat is performance-critical enough that we have assembler __strcat_chk implementations. 273 // This function is used to give better diagnostics than we can easily do from assembler. 274 extern "C" void __strcat_chk_fail(size_t dst_buf_size) { 275 __fortify_fatal("strcat: prevented write past end of %zu-byte buffer", dst_buf_size); 276 } 277 278 char* __strchr_chk(const char* p, int ch, size_t s_len) { 279 for (;; ++p, s_len--) { 280 if (__predict_false(s_len == 0)) { 281 __fortify_fatal("strchr: prevented read past end of buffer"); 282 } 283 if (*p == static_cast<char>(ch)) { 284 return const_cast<char*>(p); 285 } 286 if (*p == '\0') { 287 return NULL; 288 } 289 } 290 } 291 292 // strcpy is performance-critical enough that we have assembler __strcpy_chk implementations. 293 // This function is used to give better diagnostics than we can easily do from assembler. 294 extern "C" void __strcpy_chk_fail(size_t dst_buf_size) { 295 __fortify_fatal("strcpy: prevented write past end of %zu-byte buffer", dst_buf_size); 296 } 297 298 size_t __strlcat_chk(char* dst, const char* src, 299 size_t supplied_size, size_t dst_len_from_compiler) { 300 __check_buffer_access("strlcat", "write into", supplied_size, dst_len_from_compiler); 301 return strlcat(dst, src, supplied_size); 302 } 303 304 size_t __strlcpy_chk(char* dst, const char* src, 305 size_t supplied_size, size_t dst_len_from_compiler) { 306 __check_buffer_access("strlcpy", "write into", supplied_size, dst_len_from_compiler); 307 return strlcpy(dst, src, supplied_size); 308 } 309 310 size_t __strlen_chk(const char* s, size_t s_len) { 311 // TODO: "prevented" here would be a lie because this strlen can run off the end. 312 // strlen is too important to be expensive, so we wanted to be able to call the optimized 313 // implementation, but I think we need to implement optimized assembler __strlen_chk routines. 314 size_t ret = strlen(s); 315 if (__predict_false(ret >= s_len)) { 316 __fortify_fatal("strlen: detected read past end of buffer"); 317 } 318 return ret; 319 } 320 321 // Runtime implementation of __builtin____strncat_chk (used directly by compiler, not in headers). 322 extern "C" char* __strncat_chk(char* dst, const char* src, size_t len, size_t dst_buf_size) { 323 if (len == 0) { 324 return dst; 325 } 326 327 size_t dst_len = __strlen_chk(dst, dst_buf_size); 328 char* d = dst + dst_len; 329 dst_buf_size -= dst_len; 330 331 while (*src != '\0') { 332 *d++ = *src++; 333 len--; dst_buf_size--; 334 335 if (__predict_false(dst_buf_size == 0)) { 336 __fortify_fatal("strncat: prevented write past end of buffer"); 337 } 338 339 if (len == 0) { 340 break; 341 } 342 } 343 344 *d = '\0'; 345 return dst; 346 } 347 348 // Runtime implementation of __builtin____strncpy_chk (used directly by compiler, not in headers). 349 extern "C" char* __strncpy_chk(char* dst, const char* src, size_t len, size_t dst_len) { 350 __check_buffer_access("strncpy", "write into", len, dst_len); 351 return strncpy(dst, src, len); 352 } 353 354 // This is a variant of __strncpy_chk, but it also checks to make 355 // sure we don't read beyond the end of "src". The code for this is 356 // based on the original version of strncpy, but modified to check 357 // how much we read from "src" at the end of the copy operation. 358 char* __strncpy_chk2(char* dst, const char* src, size_t n, size_t dst_len, size_t src_len) { 359 __check_buffer_access("strncpy", "write into", n, dst_len); 360 if (n != 0) { 361 char* d = dst; 362 const char* s = src; 363 364 do { 365 if ((*d++ = *s++) == 0) { 366 // NUL pad the remaining n-1 bytes. 367 while (--n != 0) { 368 *d++ = 0; 369 } 370 break; 371 } 372 } while (--n != 0); 373 374 size_t s_copy_len = static_cast<size_t>(s - src); 375 if (__predict_false(s_copy_len > src_len)) { 376 __fortify_fatal("strncpy: detected read past end of %zu-byte buffer", src_len); 377 } 378 } 379 380 return dst; 381 } 382 383 char* __strrchr_chk(const char* p, int ch, size_t s_len) { 384 for (const char* save = NULL;; ++p, s_len--) { 385 if (s_len == 0) { 386 __fortify_fatal("strrchr: prevented read past end of buffer"); 387 } 388 if (*p == static_cast<char>(ch)) { 389 save = p; 390 } 391 if (!*p) { 392 return const_cast<char*>(save); 393 } 394 } 395 } 396 397 mode_t __umask_chk(mode_t mode) { 398 if (__predict_false((mode & 0777) != mode)) { 399 __fortify_fatal("umask: called with invalid mask %o", mode); 400 } 401 402 return umask(mode); 403 } 404 405 // Runtime implementation of __builtin____vsnprintf_chk (used directly by compiler, not in headers). 406 extern "C" int __vsnprintf_chk(char* dst, size_t supplied_size, int /*flags*/, 407 size_t dst_len_from_compiler, const char* format, va_list va) { 408 __check_buffer_access("vsnprintf", "write into", supplied_size, dst_len_from_compiler); 409 return vsnprintf(dst, supplied_size, format, va); 410 } 411 412 // Runtime implementation of __builtin____snprintf_chk (used directly by compiler, not in headers). 413 extern "C" int __snprintf_chk(char* dst, size_t supplied_size, int flags, 414 size_t dst_len_from_compiler, const char* format, ...) { 415 va_list va; 416 va_start(va, format); 417 int result = __vsnprintf_chk(dst, supplied_size, flags, dst_len_from_compiler, format, va); 418 va_end(va); 419 return result; 420 } 421 422 // Runtime implementation of __builtin____vsprintf_chk (used directly by compiler, not in headers). 423 extern "C" int __vsprintf_chk(char* dst, int /*flags*/, 424 size_t dst_len_from_compiler, const char* format, va_list va) { 425 // The compiler uses SIZE_MAX to mean "no idea", but our vsnprintf rejects sizes that large. 426 int result = vsnprintf(dst, 427 dst_len_from_compiler == SIZE_MAX ? SSIZE_MAX : dst_len_from_compiler, 428 format, va); 429 430 // Try to catch failures after the fact... 431 __check_buffer_access("vsprintf", "write into", result + 1, dst_len_from_compiler); 432 return result; 433 } 434 435 // Runtime implementation of __builtin____sprintf_chk (used directly by compiler, not in headers). 436 extern "C" int __sprintf_chk(char* dst, int flags, size_t dst_len_from_compiler, 437 const char* format, ...) { 438 va_list va; 439 va_start(va, format); 440 int result = __vsprintf_chk(dst, flags, dst_len_from_compiler, format, va); 441 va_end(va); 442 return result; 443 } 444 445 ssize_t __write_chk(int fd, const void* buf, size_t count, size_t buf_size) { 446 __check_count("write", "count", count); 447 __check_buffer_access("write", "read from", count, buf_size); 448 return write(fd, buf, count); 449 } 450 451 #if !defined(NO___STRCAT_CHK) 452 // Runtime implementation of __builtin____strcat_chk (used directly by compiler, not in headers). 453 extern "C" char* __strcat_chk(char* dst, const char* src, size_t dst_buf_size) { 454 char* save = dst; 455 size_t dst_len = __strlen_chk(dst, dst_buf_size); 456 457 dst += dst_len; 458 dst_buf_size -= dst_len; 459 460 while ((*dst++ = *src++) != '\0') { 461 dst_buf_size--; 462 if (__predict_false(dst_buf_size == 0)) { 463 __fortify_fatal("strcat: prevented write past end of %zu-byte buffer", dst_buf_size); 464 } 465 } 466 467 return save; 468 } 469 #endif // NO___STRCAT_CHK 470 471 #if !defined(NO___STRCPY_CHK) 472 // Runtime implementation of __builtin____strcpy_chk (used directly by compiler, not in headers). 473 extern "C" char* __strcpy_chk(char* dst, const char* src, size_t dst_len) { 474 // TODO: optimize so we don't scan src twice. 475 size_t src_len = strlen(src) + 1; 476 __check_buffer_access("strcpy", "write into", src_len, dst_len); 477 return strcpy(dst, src); 478 } 479 #endif // NO___STRCPY_CHK 480 481 #if !defined(NO___MEMCPY_CHK) 482 // Runtime implementation of __memcpy_chk (used directly by compiler, not in headers). 483 extern "C" void* __memcpy_chk(void* dst, const void* src, size_t count, size_t dst_len) { 484 __check_count("memcpy", "count", count); 485 __check_buffer_access("memcpy", "write into", count, dst_len); 486 return memcpy(dst, src, count); 487 } 488 #endif // NO___MEMCPY_CHK 489
