| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (c) 2012 The Native Client Authors. All rights reserved. | 2 * Copyright (c) 2012 The Native Client Authors. All rights reserved. |
| 3 * Use of this source code is governed by a BSD-style license that can be | 3 * Use of this source code is governed by a BSD-style license that can be |
| 4 * found in the LICENSE file. | 4 * found in the LICENSE file. |
| 5 */ | 5 */ |
| 6 | 6 |
| 7 #include <assert.h> | 7 #include <assert.h> |
| 8 #include <errno.h> | 8 #include <errno.h> |
| 9 #include <stddef.h> | 9 #include <stddef.h> |
| 10 #include <stdio.h> | 10 #include <stdio.h> |
| 11 #include <stdlib.h> | 11 #include <stdlib.h> |
| 12 #include <string.h> | 12 #include <string.h> |
| 13 | 13 |
| 14 #include "native_client/src/trusted/validator_ragel/unreviewed/validator_interna
l.h" | 14 #include "native_client/src/trusted/validator_ragel/validator_internal.h" |
| 15 | 15 |
| 16 /* Ignore this information: it's not used by security model in IA32 mode. */ | 16 /* Ignore this information: it's not used by security model in IA32 mode. */ |
| 17 #undef GET_VEX_PREFIX3 | 17 #undef GET_VEX_PREFIX3 |
| 18 #define GET_VEX_PREFIX3 0 | 18 #define GET_VEX_PREFIX3 0 |
| 19 #undef SET_VEX_PREFIX3 | 19 #undef SET_VEX_PREFIX3 |
| 20 #define SET_VEX_PREFIX3(P) | 20 #define SET_VEX_PREFIX3(P) |
| 21 | 21 |
| 22 %%{ | 22 %%{ |
| 23 machine x86_32_validator; | 23 machine x86_32_validator; |
| 24 alphtype unsigned char; | 24 alphtype unsigned char; |
| (...skipping 47 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 72 special_instruction = | 72 special_instruction = |
| 73 (0x83 0xe0 0xe0 0xff (0xd0|0xe0) | # naclcall/jmp %eax | 73 (0x83 0xe0 0xe0 0xff (0xd0|0xe0) | # naclcall/jmp %eax |
| 74 0x83 0xe1 0xe0 0xff (0xd1|0xe1) | # naclcall/jmp %ecx | 74 0x83 0xe1 0xe0 0xff (0xd1|0xe1) | # naclcall/jmp %ecx |
| 75 0x83 0xe2 0xe0 0xff (0xd2|0xe2) | # naclcall/jmp %edx | 75 0x83 0xe2 0xe0 0xff (0xd2|0xe2) | # naclcall/jmp %edx |
| 76 0x83 0xe3 0xe0 0xff (0xd3|0xe3) | # naclcall/jmp %ebx | 76 0x83 0xe3 0xe0 0xff (0xd3|0xe3) | # naclcall/jmp %ebx |
| 77 0x83 0xe4 0xe0 0xff (0xd4|0xe4) | # naclcall/jmp %esp | 77 0x83 0xe4 0xe0 0xff (0xd4|0xe4) | # naclcall/jmp %esp |
| 78 0x83 0xe5 0xe0 0xff (0xd5|0xe5) | # naclcall/jmp %ebp | 78 0x83 0xe5 0xe0 0xff (0xd5|0xe5) | # naclcall/jmp %ebp |
| 79 0x83 0xe6 0xe0 0xff (0xd6|0xe6) | # naclcall/jmp %esi | 79 0x83 0xe6 0xe0 0xff (0xd6|0xe6) | # naclcall/jmp %esi |
| 80 0x83 0xe7 0xe0 0xff (0xd7|0xe7)) # naclcall/jmp %edi | 80 0x83 0xe7 0xe0 0xff (0xd7|0xe7)) # naclcall/jmp %edi |
| 81 @{ | 81 @{ |
| 82 BitmapClearBit(valid_targets, (current_position - data) - 1); | 82 MakeJumpTargetInvalid((current_position - data) - 1, valid_targets); |
| 83 instruction_start -= 3; | 83 instruction_start -= 3; |
| 84 instruction_info_collected |= SPECIAL_INSTRUCTION; | 84 instruction_info_collected |= SPECIAL_INSTRUCTION; |
| 85 } | | 85 } | |
| 86 (0x65 0xa1 (0x00|0x04) 0x00 0x00 0x00 | # mov %gs:0x0/0x4,%eax | 86 (0x65 0xa1 (0x00|0x04) 0x00 0x00 0x00 | # mov %gs:0x0/0x4,%eax |
| 87 0x65 0x8b (0x05|0x0d|0x015|0x1d|0x25|0x2d|0x35|0x3d) | 87 0x65 0x8b (0x05|0x0d|0x015|0x1d|0x25|0x2d|0x35|0x3d) |
| 88 (0x00|0x04) 0x00 0x00 0x00); # mov %gs:0x0/0x4,%reg | 88 (0x00|0x04) 0x00 0x00 0x00); # mov %gs:0x0/0x4,%reg |
| 89 | 89 |
| 90 # Check if call is properly aligned | 90 # Check if call is properly aligned |
| 91 call_alignment = | 91 call_alignment = |
| 92 ((one_instruction & | 92 ((one_instruction & |
| 93 # Direct call | 93 # Direct call |
| 94 ((data16 0xe8 rel16) | | 94 ((data16 0xe8 rel16) | |
| 95 (0xe8 rel32))) | | 95 (0xe8 rel32))) | |
| 96 (special_instruction & | 96 (special_instruction & |
| 97 # Indirect call | 97 # Indirect call |
| 98 (any* data16? 0xff ((opcode_2 | opcode_3) any* & | 98 (any* data16? 0xff ((opcode_2 | opcode_3) any* & |
| 99 (modrm_memory | modrm_registers))))) | 99 (modrm_memory | modrm_registers))))) |
| 100 @{ | 100 @{ |
| 101 if (((current_position - data) & kBundleMask) != kBundleMask) | 101 if (((current_position - data) & kBundleMask) != kBundleMask) |
| 102 instruction_info_collected |= BAD_CALL_ALIGNMENT; | 102 instruction_info_collected |= BAD_CALL_ALIGNMENT; |
| 103 }; | 103 }; |
| 104 | 104 |
| 105 main := ((call_alignment | one_instruction | special_instruction) | 105 main := ((call_alignment | one_instruction | special_instruction) |
| 106 >{ | 106 >{ |
| 107 BitmapSetBit(valid_targets, current_position - data); | 107 MakeJumpTargetValid(current_position - data, valid_targets); |
| 108 } | 108 } |
| 109 @{ | 109 @{ |
| 110 if ((instruction_info_collected & | 110 if ((instruction_info_collected & |
| 111 (VALIDATION_ERRORS_MASK | BAD_CALL_ALIGNMENT)) || | 111 (VALIDATION_ERRORS_MASK | BAD_CALL_ALIGNMENT)) || |
| 112 (options & CALL_USER_CALLBACK_ON_EACH_INSTRUCTION)) { | 112 (options & CALL_USER_CALLBACK_ON_EACH_INSTRUCTION)) { |
| 113 result &= user_callback(instruction_start, current_position, | 113 result &= user_callback(instruction_start, current_position, |
| 114 instruction_info_collected, callback_data); | 114 instruction_info_collected, callback_data); |
| 115 } | 115 } |
| 116 /* On successful match the instruction start must point to the next byte | 116 /* On successful match the instruction start must point to the next byte |
| 117 * to be able to report the new offset as the start of instruction | 117 * to be able to report the new offset as the start of instruction |
| 118 * causing error. */ | 118 * causing error. */ |
| 119 instruction_start = current_position + 1; | 119 instruction_start = current_position + 1; |
| 120 instruction_info_collected = 0; | 120 instruction_info_collected = 0; |
| 121 })* | 121 })* |
| 122 $err{ | 122 $err{ |
| 123 result &= user_callback(instruction_start, current_position, | 123 result &= user_callback(instruction_start, current_position, |
| 124 UNRECOGNIZED_INSTRUCTION, callback_data); | 124 UNRECOGNIZED_INSTRUCTION, callback_data); |
| 125 continue; | 125 continue; |
| 126 }; | 126 }; |
| 127 | 127 |
| 128 }%% | 128 }%% |
| 129 | 129 |
| 130 %% write data; | 130 %% write data; |
| 131 | 131 |
| 132 | 132 |
| 133 Bool ValidateChunkIA32(const uint8_t *data, size_t size, | 133 Bool ValidateChunkIA32(const uint8_t *data, size_t size, |
| 134 enum validation_options options, | 134 enum validation_options options, |
| 135 const NaClCPUFeaturesX86 *cpu_features, | 135 const NaClCPUFeaturesX86 *cpu_features, |
| 136 validation_callback_func user_callback, | 136 ValidationCallbackFunc user_callback, |
| 137 void *callback_data) { | 137 void *callback_data) { |
| 138 bitmap_word valid_targets_small; | 138 bitmap_word valid_targets_small; |
| 139 bitmap_word jump_dests_small; | 139 bitmap_word jump_dests_small; |
| 140 bitmap_word *valid_targets; | 140 bitmap_word *valid_targets; |
| 141 bitmap_word *jump_dests; | 141 bitmap_word *jump_dests; |
| 142 const uint8_t *current_position; | 142 const uint8_t *current_position; |
| 143 const uint8_t *end_of_bundle; | 143 const uint8_t *end_of_bundle; |
| 144 int result = TRUE; | 144 int result = TRUE; |
| 145 | 145 |
| 146 CHECK(sizeof valid_targets_small == sizeof jump_dests_small); | 146 CHECK(sizeof valid_targets_small == sizeof jump_dests_small); |
| (...skipping 38 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 185 user_callback, callback_data); | 185 user_callback, callback_data); |
| 186 | 186 |
| 187 /* We only use malloc for a large code sequences */ | 187 /* We only use malloc for a large code sequences */ |
| 188 if (size > sizeof valid_targets_small) { | 188 if (size > sizeof valid_targets_small) { |
| 189 free(jump_dests); | 189 free(jump_dests); |
| 190 free(valid_targets); | 190 free(valid_targets); |
| 191 } | 191 } |
| 192 if (!result) errno = EINVAL; | 192 if (!result) errno = EINVAL; |
| 193 return result; | 193 return result; |
| 194 } | 194 } |
| OLD | NEW |