jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 1 | // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 | // Use of this source code is governed by a BSD-style license that can be |
| 3 | // found in the LICENSE file. |
| 4 | |
jln@chromium.org | 1b556f8 | 2013-01-31 02:23:43 | [diff] [blame] | 5 | #include <fcntl.h> |
avi | 9b6f4293 | 2015-12-26 22:15:14 | [diff] [blame] | 6 | #include <stddef.h> |
jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 7 | #include <stdio.h> |
| 8 | #include <stdlib.h> |
| 9 | #include <string.h> |
jln@chromium.org | 1b556f8 | 2013-01-31 02:23:43 | [diff] [blame] | 10 | #include <sys/stat.h> |
| 11 | #include <sys/types.h> |
jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 12 | |
| 13 | #include <algorithm> |
| 14 | #include <limits> |
dcheng | 093de9b | 2016-04-04 21:25:51 | [diff] [blame] | 15 | #include <memory> |
jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 16 | |
Scott Violet | 4416579 | 2018-02-22 02:08:08 | [diff] [blame] | 17 | #include "base/allocator/buildflags.h" |
brettw@chromium.org | e3177dd5 | 2014-08-13 20:22:14 | [diff] [blame] | 18 | #include "base/files/file_util.h" |
dcheng | db5935f | 2016-03-26 00:16:27 | [diff] [blame] | 19 | #include "base/memory/free_deleter.h" |
Peter Collingbourne | 5a35305d | 2019-02-06 02:51:43 | [diff] [blame] | 20 | #include "base/sanitizer_buildflags.h" |
jln@chromium.org | 547683f | 2013-02-04 23:39:48 | [diff] [blame] | 21 | #include "build/build_config.h" |
jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 22 | #include "testing/gtest/include/gtest/gtest.h" |
| 23 | |
jln@chromium.org | 547683f | 2013-02-04 23:39:48 | [diff] [blame] | 24 | #if defined(OS_POSIX) |
| 25 | #include <sys/mman.h> |
| 26 | #include <unistd.h> |
| 27 | #endif |
| 28 | |
jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 29 | using std::nothrow; |
jln@chromium.org | 9c4729b | 2013-01-26 04:41:15 | [diff] [blame] | 30 | using std::numeric_limits; |
jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 31 | |
| 32 | namespace { |
| 33 | |
jln@chromium.org | fe394f3 | 2013-02-06 03:23:49 | [diff] [blame] | 34 | // This function acts as a compiler optimization barrier. We use it to |
| 35 | // prevent the compiler from making an expression a compile-time constant. |
| 36 | // We also use it so that the compiler doesn't discard certain return values |
| 37 | // as something we don't need (see the comment with calloc below). |
| 38 | template <typename Type> |
thakis | 189ce1f | 2015-04-23 02:58:29 | [diff] [blame] | 39 | NOINLINE Type HideValueFromCompiler(volatile Type value) { |
jln@chromium.org | 1cdfdb7 | 2013-04-04 12:02:35 | [diff] [blame] | 40 | #if defined(__GNUC__) |
| 41 | // In a GCC compatible compiler (GCC or Clang), make this compiler barrier |
| 42 | // more robust than merely using "volatile". |
| 43 | __asm__ volatile ("" : "+r" (value)); |
| 44 | #endif // __GNUC__ |
jln@chromium.org | fe394f3 | 2013-02-06 03:23:49 | [diff] [blame] | 45 | return value; |
| 46 | } |
| 47 | |
primiano | 3038b2f | 2017-05-26 15:48:32 | [diff] [blame] | 48 | // TCmalloc, currently supported only by Linux/CrOS, supports malloc limits. |
Nico Weber | b80b085 | 2019-08-01 22:03:01 | [diff] [blame] | 49 | // - USE_TCMALLOC (should be set if compiled with use_allocator=="tcmalloc") |
primiano | 3038b2f | 2017-05-26 15:48:32 | [diff] [blame] | 50 | // - ADDRESS_SANITIZER it has its own memory allocator |
Sean McAllister | acb45d6 | 2020-08-19 17:14:40 | [diff] [blame] | 51 | #if (defined(OS_LINUX) || defined(OS_CHROMEOS)) && BUILDFLAG(USE_TCMALLOC) && \ |
| 52 | !defined(ADDRESS_SANITIZER) |
wfh | 74a449ca | 2015-01-13 03:11:40 | [diff] [blame] | 53 | #define MALLOC_OVERFLOW_TEST(function) function |
jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 54 | #else |
wfh | 74a449ca | 2015-01-13 03:11:40 | [diff] [blame] | 55 | #define MALLOC_OVERFLOW_TEST(function) DISABLED_##function |
jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 56 | #endif |
| 57 | |
jln@chromium.org | 9c4729b | 2013-01-26 04:41:15 | [diff] [blame] | 58 | // There are platforms where these tests are known to fail. We would like to |
| 59 | // be able to easily check the status on the bots, but marking tests as |
| 60 | // FAILS_ is too clunky. |
| 61 | void OverflowTestsSoftExpectTrue(bool overflow_detected) { |
| 62 | if (!overflow_detected) { |
Sean McAllister | acb45d6 | 2020-08-19 17:14:40 | [diff] [blame] | 63 | #if defined(OS_LINUX) || defined(OS_CHROMEOS) || defined(OS_ANDROID) || \ |
| 64 | defined(OS_APPLE) |
jln@chromium.org | 9c4729b | 2013-01-26 04:41:15 | [diff] [blame] | 65 | // Sadly, on Linux, Android, and OSX we don't have a good story yet. Don't |
| 66 | // fail the test, but report. |
| 67 | printf("Platform has overflow: %s\n", |
| 68 | !overflow_detected ? "yes." : "no."); |
| 69 | #else |
| 70 | // Otherwise, fail the test. (Note: EXPECT are ok in subfunctions, ASSERT |
| 71 | // aren't). |
| 72 | EXPECT_TRUE(overflow_detected); |
| 73 | #endif |
| 74 | } |
| 75 | } |
| 76 | |
Avi Drissman | 5b28637 | 2020-07-28 21:59:38 | [diff] [blame] | 77 | #if defined(OS_FUCHSIA) || defined(OS_APPLE) || defined(ADDRESS_SANITIZER) || \ |
| 78 | defined(THREAD_SANITIZER) || defined(MEMORY_SANITIZER) || \ |
Yuki Shiino | cdbedb5 | 2020-08-25 09:23:03 | [diff] [blame^] | 79 | BUILDFLAG(IS_HWASAN) || BUILDFLAG(USE_PARTITION_ALLOC_AS_MALLOC) |
John Abd-El-Malek | 17727ff | 2014-10-02 22:55:15 | [diff] [blame] | 80 | #define MAYBE_NewOverflow DISABLED_NewOverflow |
| 81 | #else |
| 82 | #define MAYBE_NewOverflow NewOverflow |
| 83 | #endif |
Yuki Shiino | cdbedb5 | 2020-08-25 09:23:03 | [diff] [blame^] | 84 | // Test that array[TooBig][X] and array[X][TooBig] allocations fail and not |
| 85 | // succeed with the wrong size allocation in case of size_t overflow. This |
| 86 | // test is disabled on environments that operator new (nothrow) crashes in |
| 87 | // case of size_t overflow. |
| 88 | // |
| 89 | // - iOS doesn't honor nothrow. |
| 90 | // - XSan aborts when operator new returns nullptr. |
| 91 | // - PartitionAlloc crashes by design when size_t overflows. |
| 92 | // |
Thomas Anderson | 4a6a13b | 2019-02-21 01:52:05 | [diff] [blame] | 93 | // TODO(https://crbug.com/828229): Fuchsia SDK exports an incorrect |
| 94 | // new[] that gets picked up in Debug/component builds, breaking this |
Yuki Shiino | cdbedb5 | 2020-08-25 09:23:03 | [diff] [blame^] | 95 | // test. Disabled on Mac for the same reason. |
John Abd-El-Malek | 17727ff | 2014-10-02 22:55:15 | [diff] [blame] | 96 | TEST(SecurityTest, MAYBE_NewOverflow) { |
jln@chromium.org | 9c4729b | 2013-01-26 04:41:15 | [diff] [blame] | 97 | const size_t kArraySize = 4096; |
| 98 | // We want something "dynamic" here, so that the compiler doesn't |
| 99 | // immediately reject crazy arrays. |
| 100 | const size_t kDynamicArraySize = HideValueFromCompiler(kArraySize); |
thakis | 4d7b56b | 2017-02-14 16:21:35 | [diff] [blame] | 101 | const size_t kMaxSizeT = std::numeric_limits<size_t>::max(); |
jln@chromium.org | 9c4729b | 2013-01-26 04:41:15 | [diff] [blame] | 102 | const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; |
| 103 | const size_t kDynamicArraySize2 = HideValueFromCompiler(kArraySize2); |
| 104 | { |
dcheng | 093de9b | 2016-04-04 21:25:51 | [diff] [blame] | 105 | std::unique_ptr<char[][kArraySize]> array_pointer( |
| 106 | new (nothrow) char[kDynamicArraySize2][kArraySize]); |
thakis | 4d7b56b | 2017-02-14 16:21:35 | [diff] [blame] | 107 | // Prevent clang from optimizing away the whole test. |
| 108 | char* volatile p = reinterpret_cast<char*>(array_pointer.get()); |
| 109 | OverflowTestsSoftExpectTrue(!p); |
jln@chromium.org | 9c4729b | 2013-01-26 04:41:15 | [diff] [blame] | 110 | } |
jln@chromium.org | 1cdfdb7 | 2013-04-04 12:02:35 | [diff] [blame] | 111 | // On windows, the compiler prevents static array sizes of more than |
| 112 | // 0x7fffffff (error C2148). |
Peter Kasting | be940e9 | 2014-11-20 23:14:08 | [diff] [blame] | 113 | #if defined(OS_WIN) && defined(ARCH_CPU_64_BITS) |
| 114 | ALLOW_UNUSED_LOCAL(kDynamicArraySize); |
| 115 | #else |
jln@chromium.org | 9c4729b | 2013-01-26 04:41:15 | [diff] [blame] | 116 | { |
dcheng | 093de9b | 2016-04-04 21:25:51 | [diff] [blame] | 117 | std::unique_ptr<char[][kArraySize2]> array_pointer( |
| 118 | new (nothrow) char[kDynamicArraySize][kArraySize2]); |
thakis | 4d7b56b | 2017-02-14 16:21:35 | [diff] [blame] | 119 | // Prevent clang from optimizing away the whole test. |
| 120 | char* volatile p = reinterpret_cast<char*>(array_pointer.get()); |
| 121 | OverflowTestsSoftExpectTrue(!p); |
jln@chromium.org | 9c4729b | 2013-01-26 04:41:15 | [diff] [blame] | 122 | } |
jln@chromium.org | 1cdfdb7 | 2013-04-04 12:02:35 | [diff] [blame] | 123 | #endif // !defined(OS_WIN) || !defined(ARCH_CPU_64_BITS) |
jln@chromium.org | 9c4729b | 2013-01-26 04:41:15 | [diff] [blame] | 124 | } |
| 125 | |
Sean McAllister | acb45d6 | 2020-08-19 17:14:40 | [diff] [blame] | 126 | #if (defined(OS_LINUX) || defined(OS_CHROMEOS)) && defined(__x86_64__) |
jln@chromium.org | 547683f | 2013-02-04 23:39:48 | [diff] [blame] | 127 | // Check if ptr1 and ptr2 are separated by less than size chars. |
| 128 | bool ArePointersToSameArea(void* ptr1, void* ptr2, size_t size) { |
| 129 | ptrdiff_t ptr_diff = reinterpret_cast<char*>(std::max(ptr1, ptr2)) - |
| 130 | reinterpret_cast<char*>(std::min(ptr1, ptr2)); |
| 131 | return static_cast<size_t>(ptr_diff) <= size; |
| 132 | } |
| 133 | |
jln@chromium.org | 1b556f8 | 2013-01-31 02:23:43 | [diff] [blame] | 134 | // Check if TCMalloc uses an underlying random memory allocator. |
wfh | 74a449ca | 2015-01-13 03:11:40 | [diff] [blame] | 135 | TEST(SecurityTest, MALLOC_OVERFLOW_TEST(RandomMemoryAllocations)) { |
jln@chromium.org | 547683f | 2013-02-04 23:39:48 | [diff] [blame] | 136 | size_t kPageSize = 4096; // We support x86_64 only. |
| 137 | // Check that malloc() returns an address that is neither the kernel's |
| 138 | // un-hinted mmap area, nor the current brk() area. The first malloc() may |
| 139 | // not be at a random address because TCMalloc will first exhaust any memory |
| 140 | // that it has allocated early on, before starting the sophisticated |
| 141 | // allocators. |
| 142 | void* default_mmap_heap_address = |
Ivan Kotenkov | a16212a5 | 2017-11-08 12:37:33 | [diff] [blame] | 143 | mmap(nullptr, kPageSize, PROT_READ | PROT_WRITE, |
| 144 | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); |
jln@chromium.org | 547683f | 2013-02-04 23:39:48 | [diff] [blame] | 145 | ASSERT_NE(default_mmap_heap_address, |
| 146 | static_cast<void*>(MAP_FAILED)); |
| 147 | ASSERT_EQ(munmap(default_mmap_heap_address, kPageSize), 0); |
| 148 | void* brk_heap_address = sbrk(0); |
| 149 | ASSERT_NE(brk_heap_address, reinterpret_cast<void*>(-1)); |
Ivan Kotenkov | a16212a5 | 2017-11-08 12:37:33 | [diff] [blame] | 150 | ASSERT_TRUE(brk_heap_address != nullptr); |
jln@chromium.org | 547683f | 2013-02-04 23:39:48 | [diff] [blame] | 151 | // 1 MB should get us past what TCMalloc pre-allocated before initializing |
| 152 | // the sophisticated allocators. |
| 153 | size_t kAllocSize = 1<<20; |
dcheng | 093de9b | 2016-04-04 21:25:51 | [diff] [blame] | 154 | std::unique_ptr<char, base::FreeDeleter> ptr( |
jln@chromium.org | 547683f | 2013-02-04 23:39:48 | [diff] [blame] | 155 | static_cast<char*>(malloc(kAllocSize))); |
Ivan Kotenkov | a16212a5 | 2017-11-08 12:37:33 | [diff] [blame] | 156 | ASSERT_TRUE(ptr != nullptr); |
jln@chromium.org | 547683f | 2013-02-04 23:39:48 | [diff] [blame] | 157 | // If two pointers are separated by less than 512MB, they are considered |
| 158 | // to be in the same area. |
| 159 | // Our random pointer could be anywhere within 0x3fffffffffff (46bits), |
| 160 | // and we are checking that it's not withing 1GB (30 bits) from two |
| 161 | // addresses (brk and mmap heap). We have roughly one chance out of |
| 162 | // 2^15 to flake. |
| 163 | const size_t kAreaRadius = 1<<29; |
| 164 | bool in_default_mmap_heap = ArePointersToSameArea( |
| 165 | ptr.get(), default_mmap_heap_address, kAreaRadius); |
| 166 | EXPECT_FALSE(in_default_mmap_heap); |
| 167 | |
| 168 | bool in_default_brk_heap = ArePointersToSameArea( |
| 169 | ptr.get(), brk_heap_address, kAreaRadius); |
| 170 | EXPECT_FALSE(in_default_brk_heap); |
| 171 | |
| 172 | // In the implementation, we always mask our random addresses with |
| 173 | // kRandomMask, so we use it as an additional detection mechanism. |
| 174 | const uintptr_t kRandomMask = 0x3fffffffffffULL; |
| 175 | bool impossible_random_address = |
| 176 | reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; |
| 177 | EXPECT_FALSE(impossible_random_address); |
jln@chromium.org | 1b556f8 | 2013-01-31 02:23:43 | [diff] [blame] | 178 | } |
| 179 | |
Sean McAllister | acb45d6 | 2020-08-19 17:14:40 | [diff] [blame] | 180 | #endif // (defined(OS_LINUX) || defined(OS_CHROMEOS)) && defined(__x86_64__) |
jln@chromium.org | 1b556f8 | 2013-01-31 02:23:43 | [diff] [blame] | 181 | |
jln@chromium.org | b5bf9a13 | 2013-01-15 20:16:33 | [diff] [blame] | 182 | } // namespace |