History

fix for the bcheck.o (bug #14958)

- care about __attribute__ redefinition in the system headers - an invalid pointer must be returned when (addr >= e->size), and not (addr > e->size) A test program: #include <stdio.h> #include <stdlib.h> int main () { int v[10]; fprintf(stderr, "&v[0] = %p\n", &v[0]); fprintf(stderr, "&v[10] = %p\n", &v[10]); exit(1); return 0; } // tcc -b test.c The output before a patch: &v[0] = 0xbf929d8c &v[10] = 0xbf929db4 The output after a patch: &v[0] = 0xbff6e33c &v[10] = 0xfffffffe

seyko committed 11 years ago

Commit d80593b1 parent f2cfc072 files · +60 −14Browse files

Unified · Split

2 files
  1. lib/bcheck.c +59 −13
  2. tccelf.c +1 −1
lib/bcheck.c+59−13
@@ -80,6 +80,10 @@ void __bound_init(void); · 79 unmodified lines
8080 void __bound_new_region(void *p, size_t size);
8181 int __bound_delete_region(void *p);
8282
83+#ifdef __attribute__
84+ /* __attribute__ is redifened in system headers */
85+ #undef __attribute__
86+#endif
8387 #define FASTCALL __attribute__((regparm(3)))
8488
8589 void *__bound_malloc(size_t size, const void *caller);
@@ -161,7 +165,7 @@ void * FASTCALL __bound_ptr_add(void *p, size_t offset) · 75 unmodified lines
161165 size_t addr = (size_t)p;
162166 BoundEntry *e;
163167 #if defined(BOUND_DEBUG)
164− printf("add: 0x%x %d\n", (int)p, offset);
168+ printf("%s %s: 0x%x %d\n", __FILE__, __FUNCTION__, (int)p, offset);
165169 #endif
166170
167171 e = __bound_t1[addr >> (BOUND_T2_BITS + BOUND_T3_BITS)];
@@ -174,15 +178,19 @@ void * FASTCALL __bound_ptr_add(void *p, size_t offset) · 6 unmodified lines
174178 addr = (size_t)p - e->start;
175179 }
176180 addr += offset;
177− if (addr > e->size)
181+ if (addr >= e->size) {
182+ #if defined(BOUND_DEBUG)
183+ printf("%s %s: 0x%zx is outside of the region\n", __FILE__, __FUNCTION__, p + offset);
184+ #endif
178185 return INVALID_POINTER; /* return an invalid pointer */
186+ }
179187 return p + offset;
180188 }
181189
182190 /* return '(p + offset)' for pointer indirection (the resulting must
183191 be strictly inside the region */
184192 #define BOUND_PTR_INDIR(dsize) \
185−void * FASTCALL __bound_ptr_indir ## dsize (void *p, int offset) \
193+void * FASTCALL __bound_ptr_indir ## dsize (void *p, size_t offset) \
186194 { \
187195 size_t addr = (size_t)p; \
188196 BoundEntry *e; \
@@ -197,7 +205,7 @@ void * FASTCALL __bound_ptr_indir ## dsize (void *p, int offset) \ · 8 unmodified lines
197205 addr = (size_t)p - e->start; \
198206 } \
199207 addr += offset + dsize; \
200− if (addr > e->size) \
208+ if (addr >= e->size) \
201209 return INVALID_POINTER; /* return an invalid pointer */ \
202210 return p + offset; \
203211 }
@@ -219,6 +227,9 @@ BOUND_PTR_INDIR(16) · 15 unmodified lines
219227 void FASTCALL __bound_local_new(void *p1)
220228 {
221229 size_t addr, size, fp, *p = p1;
230+#ifdef BOUND_DEBUG
231+ fprintf(stderr, "%s, %s start p1=%zx *p1=%zx\n", __FILE__, __FUNCTION__, p, *p);
232+#endif
222233 GET_CALLER_FP(fp);
223234 for(;;) {
224235 addr = p[0];
@@ -229,6 +240,9 @@ void FASTCALL __bound_local_new(void *p1) · 4 unmodified lines
229240 p += 2;
230241 __bound_new_region((void *)addr, size);
231242 }
243+#ifdef BOUND_DEBUG
244+ fprintf(stderr, "%s, %s end\n", __FILE__, __FUNCTION__);
245+#endif
232246 }
233247
234248 /* called when leaving a function to delete all the local regions */
@@ -348,9 +362,11 @@ void __bound_init(void) · 113 unmodified lines
348362 int i;
349363 BoundEntry *page;
350364 size_t start, size;
365+ size_t *p;
351366
352− /* int *p; */
353− __PTRDIFF_TYPE__ *p; /* 32 or 64 bit integer */
367+#ifdef BOUND_DEBUG
368+ fprintf(stderr, "%s, %s() start\n", __FILE__, __FUNCTION__);
369+#endif
354370
355371 /* save malloc hooks and install bound check hooks */
356372 install_malloc_hooks();
@@ -413,17 +429,24 @@ void __bound_init(void) · 56 unmodified lines
413429 #endif
414430
415431 /* add all static bound check values */
416− p = (__PTRDIFF_TYPE__ *)&__bounds_start;
432+ p = (size_t *)&__bounds_start;
417433 while (p[0] != 0) {
418434 __bound_new_region((void *)p[0], p[1]);
419435 p += 2;
420436 }
437+#ifdef BOUND_DEBUG
438+ fprintf(stderr, "%s, %s() end\n\n", __FILE__, __FUNCTION__);
439+#endif
421440 }
422441
423442 void __bound_main_arg(void **p)
424443 {
425444 void *start = p;
426445 while (*p++);
446+#ifdef BOUND_DEBUG
447+ fprintf(stderr, "%s, %s calling __bound_new_region(%p, %llx)\n",
448+ __FILE__, __FUNCTION__, (void *) p - start);
449+#endif
427450 __bound_new_region(start, (void *) p - start);
428451 }
429452
@@ -459,6 +482,11 @@ void __bound_new_region(void *p, size_t size) · 29 unmodified lines
459482 BoundEntry *page, *e, *e2;
460483 size_t t1_start, t1_end, i, t2_start, t2_end;
461484
485+#ifdef BOUND_DEBUG
486+ fprintf(stderr, "%s, %s(%p, %zx) start\n",
487+ __FILE__, __FUNCTION__, p, size);
488+#endif
489+
462490 start = (size_t)p;
463491 end = start + size;
464492 t1_start = start >> (BOUND_T2_BITS + BOUND_T3_BITS);
@@ -470,10 +498,7 @@ void __bound_new_region(void *p, size_t size) · 5 unmodified lines
470498 ((BOUND_T2_SIZE - 1) << BOUND_E_BITS);
471499 t2_end = (end >> (BOUND_T3_BITS - BOUND_E_BITS)) &
472500 ((BOUND_T2_SIZE - 1) << BOUND_E_BITS);
473−#ifdef BOUND_DEBUG
474− printf("new %lx %lx %x %x %x %x\n",
475− start, end, t1_start, t1_end, t2_start, t2_end);
476−#endif
501+
477502
478503 e = (BoundEntry *)((char *)page + t2_start);
479504 add_region(e, start, size);
@@ -515,6 +540,9 @@ void __bound_new_region(void *p, size_t size) · 35 unmodified lines
515540 }
516541 add_region(e, start, size);
517542 }
543+#ifdef BOUND_DEBUG
544+ fprintf(stderr, "%s, %s end\n", __FILE__, __FUNCTION__);
545+#endif
518546 }
519547
520548 /* delete a region */
@@ -567,6 +595,10 @@ int __bound_delete_region(void *p) · 46 unmodified lines
567595 BoundEntry *page, *e, *e2;
568596 size_t t1_start, t1_end, t2_start, t2_end, i;
569597
598+#ifdef BOUND_DEBUG
599+ fprintf(stderr, "%s %s() start\n", __FILE__, __FUNCTION__);
600+#endif
601+
570602 start = (size_t)p;
571603 t1_start = start >> (BOUND_T2_BITS + BOUND_T3_BITS);
572604 t2_start = (start >> (BOUND_T3_BITS - BOUND_E_BITS)) &
@@ -633,6 +665,11 @@ int __bound_delete_region(void *p) · 60 unmodified lines
633665 }
634666 delete_region(e, p, empty_size);
635667 }
668+
669+#ifdef BOUND_DEBUG
670+ fprintf(stderr, "%s %s() end\n", __FILE__, __FUNCTION__);
671+#endif
672+
636673 return 0;
637674 }
638675
@@ -718,6 +755,11 @@ void *__bound_malloc(size_t size, const void *caller) · 79 unmodified lines
718755
719756 if (!ptr)
720757 return NULL;
758+
759+#ifdef BOUND_DEBUG
760+ fprintf(stderr, "%s, %s calling __bound_new_region(%p, %llx)\n",
761+ __FILE__, __FUNCTION__, ptr, size);
762+#endif
721763 __bound_new_region(ptr, size);
722764 return ptr;
723765 }
@@ -747,6 +789,11 @@ void *__bound_memalign(size_t size, size_t align, const void *caller) · 23 unmodified lines
747789
748790 if (!ptr)
749791 return NULL;
792+
793+#ifdef BOUND_DEBUG
794+ fprintf(stderr, "%s, %s calling __bound_new_region(%p, %llx)\n",
795+ __FILE__, __FUNCTION__, ptr, size);
796+#endif
750797 __bound_new_region(ptr, size);
751798 return ptr;
752799 }
@@ -861,7 +908,7 @@ void *__bound_memset(void *dst, int c, size_t size) · 108 unmodified lines
861908 int __bound_strlen(const char *s)
862909 {
863910 const char *p;
864− int len;
911+ size_t len;
865912
866913 len = 0;
867914 for(;;) {
@@ -881,4 +928,3 @@ char *__bound_strcpy(char *dst, const char *src) · 13 unmodified lines
881928 len = __bound_strlen(src);
882929 return __bound_memcpy(dst, src, len + 1);
883930 }
884−
tccelf.c+1−1
@@ -1577,7 +1577,7 @@ ST_FUNC void tcc_add_bcheck(TCCState *s1) · 1576 unmodified lines
15771577 return;
15781578
15791579 /* XXX: add an object file to do that */
1580− ptr = section_ptr_add(bounds_section, sizeof(unsigned long));
1580+ ptr = section_ptr_add(bounds_section, sizeof(*ptr));
15811581 *ptr = 0;
15821582 add_elf_sym(symtab_section, 0, 0,
15831583 ELFW(ST_INFO)(STB_GLOBAL, STT_NOTYPE), 0,

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t