Index: src/processor/exploitability_linux.cc |
=================================================================== |
--- src/processor/exploitability_linux.cc (revision 1481) |
+++ src/processor/exploitability_linux.cc (working copy) |
@@ -102,6 +102,7 @@ |
// Check if the instruction pointer is in a valid instruction region |
// by finding if it maps to an executable part of memory. |
uint64_t instruction_ptr = 0; |
+ uint64_t stack_ptr = 0; |
const MinidumpContext *context = exception->GetContext(); |
if (context == NULL) { |
@@ -115,8 +116,15 @@ |
return EXPLOITABILITY_ERR_PROCESSING; |
} |
+ // Getting the stack pointer. |
+ if (!context->GetStackPointer(&stack_ptr)) { |
+ BPLOG(INFO) << "Failed to retrieve stack pointer."; |
+ return EXPLOITABILITY_ERR_PROCESSING; |
+ } |
+ |
// Checking for the instruction pointer in a valid instruction region. |
- if (!this->InstructionPointerInCode(instruction_ptr)) { |
+ if (!this->InstructionPointerInCode(instruction_ptr) || |
+ this->StackPointerOffStack(stack_ptr)) { |
return EXPLOITABILITY_HIGH; |
} |
@@ -125,6 +133,22 @@ |
return EXPLOITABILITY_INTERESTING; |
} |
+bool ExploitabilityLinux::StackPointerOffStack(uint64_t stack_ptr) { |
+ MinidumpLinuxMapsList *linux_maps_list = dump_->GetLinuxMapsList(); |
+ // Inconclusive if there are no mappings available. |
+ if (!linux_maps_list) { |
+ return false; |
+ } |
+ const MinidumpLinuxMaps *linux_maps = |
+ linux_maps_list->GetLinuxMapsForAddress(stack_ptr); |
+ // Checks if the stack pointer maps to a valid mapping and if the mapping |
+ // is not the stack. If the mapping has no name, it is inconclusive whether |
+ // it is off the stack. |
+ return !linux_maps || |
+ (linux_maps->GetPathname().compare("") && |
+ linux_maps->GetPathname().compare("[stack]")); |
+} |
+ |
bool ExploitabilityLinux::InstructionPointerInCode(uint64_t instruction_ptr) { |
// Get Linux memory mapping from /proc/self/maps. Checking whether the |
// region the instruction pointer is in has executable permission can tell |