| Index: src/processor/exploitability_linux.cc
|
| ===================================================================
|
| --- src/processor/exploitability_linux.cc (revision 1481)
|
| +++ src/processor/exploitability_linux.cc (working copy)
|
| @@ -102,6 +102,7 @@
|
| // Check if the instruction pointer is in a valid instruction region
|
| // by finding if it maps to an executable part of memory.
|
| uint64_t instruction_ptr = 0;
|
| + uint64_t stack_ptr = 0;
|
|
|
| const MinidumpContext *context = exception->GetContext();
|
| if (context == NULL) {
|
| @@ -115,8 +116,15 @@
|
| return EXPLOITABILITY_ERR_PROCESSING;
|
| }
|
|
|
| + // Getting the stack pointer.
|
| + if (!context->GetStackPointer(&stack_ptr)) {
|
| + BPLOG(INFO) << "Failed to retrieve stack pointer.";
|
| + return EXPLOITABILITY_ERR_PROCESSING;
|
| + }
|
| +
|
| // Checking for the instruction pointer in a valid instruction region.
|
| - if (!this->InstructionPointerInCode(instruction_ptr)) {
|
| + if (!this->InstructionPointerInCode(instruction_ptr) ||
|
| + this->StackPointerOffStack(stack_ptr)) {
|
| return EXPLOITABILITY_HIGH;
|
| }
|
|
|
| @@ -125,6 +133,22 @@
|
| return EXPLOITABILITY_INTERESTING;
|
| }
|
|
|
| +bool ExploitabilityLinux::StackPointerOffStack(uint64_t stack_ptr) {
|
| + MinidumpLinuxMapsList *linux_maps_list = dump_->GetLinuxMapsList();
|
| + // Inconclusive if there are no mappings available.
|
| + if (!linux_maps_list) {
|
| + return false;
|
| + }
|
| + const MinidumpLinuxMaps *linux_maps =
|
| + linux_maps_list->GetLinuxMapsForAddress(stack_ptr);
|
| + // Checks if the stack pointer maps to a valid mapping and if the mapping
|
| + // is not the stack. If the mapping has no name, it is inconclusive whether
|
| + // it is off the stack.
|
| + return !linux_maps ||
|
| + (linux_maps->GetPathname().compare("") &&
|
| + linux_maps->GetPathname().compare("[stack]"));
|
| +}
|
| +
|
| bool ExploitabilityLinux::InstructionPointerInCode(uint64_t instruction_ptr) {
|
| // Get Linux memory mapping from /proc/self/maps. Checking whether the
|
| // region the instruction pointer is in has executable permission can tell
|
|
|