OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <fcntl.h> | 5 #include <fcntl.h> |
6 #include <stdio.h> | 6 #include <stdio.h> |
7 #include <stdlib.h> | 7 #include <stdlib.h> |
8 #include <string.h> | 8 #include <string.h> |
9 #include <sys/stat.h> | 9 #include <sys/stat.h> |
10 #include <sys/types.h> | 10 #include <sys/types.h> |
(...skipping 272 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
283 scoped_ptr<char[][kArraySize2]> array_pointer(new (nothrow) | 283 scoped_ptr<char[][kArraySize2]> array_pointer(new (nothrow) |
284 char[kDynamicArraySize][kArraySize2]); | 284 char[kDynamicArraySize][kArraySize2]); |
285 OverflowTestsSoftExpectTrue(!array_pointer); | 285 OverflowTestsSoftExpectTrue(!array_pointer); |
286 } | 286 } |
287 #endif // !defined(OS_WIN) || !defined(ARCH_CPU_64_BITS) | 287 #endif // !defined(OS_WIN) || !defined(ARCH_CPU_64_BITS) |
288 } | 288 } |
289 | 289 |
290 // Call calloc(), eventually free the memory and return whether or not | 290 // Call calloc(), eventually free the memory and return whether or not |
291 // calloc() did succeed. | 291 // calloc() did succeed. |
292 bool CallocReturnsNull(size_t nmemb, size_t size) { | 292 bool CallocReturnsNull(size_t nmemb, size_t size) { |
| 293 // We need the two calls to HideValueFromCompiler(): we have seen LLVM |
| 294 // optimize away the call to calloc() entirely and assume the pointer to not |
| 295 // be NULL. |
293 scoped_ptr<char, base::FreeDeleter> array_pointer( | 296 scoped_ptr<char, base::FreeDeleter> array_pointer( |
294 static_cast<char*>(calloc(nmemb, size))); | 297 static_cast<char*>(HideValueFromCompiler(calloc(nmemb, size)))); |
295 // We need the call to HideValueFromCompiler(): we have seen LLVM | |
296 // optimize away the call to calloc() entirely and assume | |
297 // the pointer to not be NULL. | |
298 return HideValueFromCompiler(array_pointer.get()) == NULL; | 298 return HideValueFromCompiler(array_pointer.get()) == NULL; |
299 } | 299 } |
300 | 300 |
301 // Test if calloc() can overflow. | 301 // Test if calloc() can overflow. |
302 TEST(SecurityTest, CallocOverflow) { | 302 TEST(SecurityTest, CallocOverflow) { |
303 const size_t kArraySize = 4096; | 303 const size_t kArraySize = 4096; |
304 const size_t kMaxSizeT = numeric_limits<size_t>::max(); | 304 const size_t kMaxSizeT = numeric_limits<size_t>::max(); |
305 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; | 305 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; |
306 if (!CallocDiesOnOOM()) { | 306 if (!CallocDiesOnOOM()) { |
307 EXPECT_TRUE(CallocReturnsNull(kArraySize, kArraySize2)); | 307 EXPECT_TRUE(CallocReturnsNull(kArraySize, kArraySize2)); |
(...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
367 // kRandomMask, so we use it as an additional detection mechanism. | 367 // kRandomMask, so we use it as an additional detection mechanism. |
368 const uintptr_t kRandomMask = 0x3fffffffffffULL; | 368 const uintptr_t kRandomMask = 0x3fffffffffffULL; |
369 bool impossible_random_address = | 369 bool impossible_random_address = |
370 reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; | 370 reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; |
371 EXPECT_FALSE(impossible_random_address); | 371 EXPECT_FALSE(impossible_random_address); |
372 } | 372 } |
373 | 373 |
374 #endif // defined(OS_LINUX) && defined(__x86_64__) | 374 #endif // defined(OS_LINUX) && defined(__x86_64__) |
375 | 375 |
376 } // namespace | 376 } // namespace |
OLD | NEW |