Chromium Code Reviews| Index: src/processor/exploitability_linux.cc |
| =================================================================== |
| --- src/processor/exploitability_linux.cc (revision 1481) |
| +++ src/processor/exploitability_linux.cc (working copy) |
| @@ -102,6 +102,7 @@ |
| // Check if the instruction pointer is in a valid instruction region |
| // by finding if it maps to an executable part of memory. |
| uint64_t instruction_ptr = 0; |
| + uint64_t stack_ptr = 0; |
| const MinidumpContext *context = exception->GetContext(); |
| if (context == NULL) { |
| @@ -115,8 +116,15 @@ |
| return EXPLOITABILITY_ERR_PROCESSING; |
| } |
| + // Getting the stack pointer. |
| + if (!context->GetStackPointer(&stack_ptr)) { |
| + BPLOG(INFO) << "Failed to retrieve stack pointer."; |
| + return EXPLOITABILITY_ERR_PROCESSING; |
| + } |
| + |
| // Checking for the instruction pointer in a valid instruction region. |
| - if (!this->InstructionPointerInCode(instruction_ptr)) { |
| + if (!this->InstructionPointerInCode(instruction_ptr) || |
| + this->StackPointerOffStack(stack_ptr)) { |
| return EXPLOITABILITY_HIGH; |
| } |
| @@ -125,6 +133,22 @@ |
| return EXPLOITABILITY_INTERESTING; |
| } |
| +bool ExploitabilityLinux::StackPointerOffStack(uint64_t stack_ptr) { |
|
ivanpe
2015/08/12 00:31:59
Please, consider adding a unittest for this method
liuandrew
2015/08/14 22:43:16
Done.
|
| + MinidumpLinuxMapsList *linux_maps_list = dump_->GetLinuxMapsList(); |
| + // Inconclusive if there are no mappings available. |
| + if (linux_maps_list == NULL) { |
|
ivanpe
2015/08/12 00:31:59
Please, be consistent when checking for NULL. I t
liuandrew
2015/08/14 22:43:16
Done.
|
| + return false; |
| + } |
| + const MinidumpLinuxMaps *linux_maps = |
| + linux_maps_list->GetLinuxMapsForAddress(stack_ptr); |
| + // Checks if the stack pointer maps to a valid mapping and if the mapping |
| + // is not the stack. If the mapping has no name, it is inconclusive whether |
| + // it is off the stack. |
| + return !linux_maps || |
| + (linux_maps->GetPathname().compare("") && |
| + linux_maps->GetPathname().compare("[stack]")); |
| +} |
| + |
| bool ExploitabilityLinux::InstructionPointerInCode(uint64_t instruction_ptr) { |
| // Get Linux memory mapping from /proc/self/maps. Checking whether the |
| // region the instruction pointer is in has executable permission can tell |