diff options
| author | Ulrich Drepper <drepper@redhat.com> | 2009-05-15 19:28:04 -0700 |
|---|---|---|
| committer | Ulrich Drepper <drepper@redhat.com> | 2009-05-15 19:37:13 -0700 |
| commit | b50f8e42ba3010f0141e6a482e0820f658e89b63 (patch) | |
| tree | 80cef469731d5857499883d45fd3424730f0db7c /sysdeps/i386 | |
| parent | f1342e0be8e222dbca077beca94b5937564e8c4b (diff) | |
| download | glibc-b50f8e42ba3010f0141e6a482e0820f658e89b63.tar.gz glibc-b50f8e42ba3010f0141e6a482e0820f658e89b63.tar.xz glibc-b50f8e42ba3010f0141e6a482e0820f658e89b63.zip | |
Check for valid stack frame in longjmp.
If longjmp restores the stack frame to an address which is beyond the stack frame at the time of the longjmp call it would install an uninitialized stack frame. If compiled with _FORTIFY_SOURCE defined, longjmp will now bail out in this situation.
Diffstat (limited to 'sysdeps/i386')
| -rw-r--r-- | sysdeps/i386/____longjmp_chk.S | 45 | ||||
| -rw-r--r-- | sysdeps/i386/__longjmp.S | 11 |
2 files changed, 55 insertions, 1 deletions
diff --git a/sysdeps/i386/____longjmp_chk.S b/sysdeps/i386/____longjmp_chk.S new file mode 100644 index 0000000000..6cd74968a2 --- /dev/null +++ b/sysdeps/i386/____longjmp_chk.S @@ -0,0 +1,45 @@ +/* Copyright (C) 2001,2004,2005,2006,2009 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, write to the Free + Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA + 02111-1307 USA. */ + + .section .rodata.str1.1,"aMS",@progbits,1 + .type longjmp_msg,@object +longjmp_msg: + .string "longjmp causes uninitialized stack frame" + .size longjmp_msg, .-longjmp_msg + + +#define __longjmp ____longjmp_chk + +#ifdef PIC +# define CALL_FAIL movl %ebx, %ecx; \ + cfi_register(%ebx,%ecx); \ + LOAD_PIC_REG (bx); \ + leal longjmp_msg@GOTOFF(%ebx), %eax; \ + call __GI___fortify_fail@PLT +#else +# define CALL_FAIL movl $longjmp_msg, %eax; \ + call __fortify_fail +#endif + +#define CHECK_ESP(reg) \ + cmpl reg, %esp; \ + jbe .Lok; \ + CALL_FAIL; \ +.Lok: + +#include "__longjmp.S" diff --git a/sysdeps/i386/__longjmp.S b/sysdeps/i386/__longjmp.S index 559d56b250..15c9e55ec7 100644 --- a/sysdeps/i386/__longjmp.S +++ b/sysdeps/i386/__longjmp.S @@ -1,5 +1,6 @@ /* longjmp for i386. - Copyright (C) 1995-1998,2000,2002,2005, 2006 Free Software Foundation, Inc. + Copyright (C) 1995-1998,2000,2002,2005,2006,2009 + Free Software Foundation, Inc. This file is part of the GNU C Library. The GNU C Library is free software; you can redistribute it and/or @@ -40,6 +41,9 @@ ENTRY (BP_SYM (__longjmp)) movl (JB_SP*4)(%eax), %ecx PTR_DEMANGLE (%edx) PTR_DEMANGLE (%ecx) +# ifdef CHECK_ESP + CHECK_ESP (%ecx) +# endif cfi_def_cfa(%eax, 0) cfi_register(%eip, %edx) cfi_register(%esp, %ecx) @@ -63,6 +67,11 @@ ENTRY (BP_SYM (__longjmp)) movl JBUF(%esp), %ecx /* User's jmp_buf in %ecx. */ CHECK_BOUNDS_BOTH_WIDE (%ecx, JBUF(%esp), $JB_SIZE) +# ifdef CHECK_ESP + movl (JB_SP*4)(%ecx), %eax + CHECK_ESP (%eax) +# endif + movl VAL(%esp), %eax /* Second argument is return value. */ /* Save the return address now. */ movl (JB_PC*4)(%ecx), %edx |