Add check for executable stack/heap when rating Linux exploitability.

src/processor/exploitability_linux.cc

 // Copyright (c) 2013 Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 98 matching lines @@
     return EXPLOITABILITY_ERR_PROCESSING;
   }
 
   // Getting the instruction pointer.
   if (!context->GetInstructionPointer(&instruction_ptr)) {
     BPLOG(INFO) << "Failed to retrieve instruction pointer.";
     return EXPLOITABILITY_ERR_PROCESSING;
   }
 
   // Checking for the instruction pointer in a valid instruction region.
-  if (!this->InstructionPointerInCode(instruction_ptr)) {
+  if (!this->InstructionPointerInCode(instruction_ptr) ||
+       this->ExecutableStackOrHeap()) {
     return EXPLOITABILITY_HIGH;
   }
 
   // There was no strong evidence suggesting exploitability, but the minidump
   // does not appear totally benign either.
   return EXPLOITABILITY_INTERESTING;
 }
 
+bool ExploitabilityLinux::ExecutableStackOrHeap() {
+  MinidumpLinuxMapsList *linux_maps_list = dump_->GetLinuxMapsList();
+  if (linux_maps_list) {
+    for (size_t i = 0; i < linux_maps_list->mapping_count(); i++) {
+      const MinidumpLinuxMaps *linux_maps = linux_maps_list->GetLinuxMapsAtIndex(i);

[ivanpe, 2015/08/12 00:26:23]

Lines should not exceed 80 chars

[liuandrew, 2015/08/14 22:43:36]

Done.

+      // Check for executable stack or heap for each mapping.
+      if (linux_maps &&
+          (!linux_maps->GetPathname().compare("[stack]") ||
+           !linux_maps->GetPathname().compare("[heap]")) &&
+          linux_maps->IsExecutable()) {
+        return true;
+      }
+    }
+  }
+  return false;

[ivanpe, 2015/08/12 00:26:23]

Please add a unittest for this method.

[liuandrew, 2015/08/14 22:43:36]

Done.

+}
+
 bool ExploitabilityLinux::InstructionPointerInCode(uint64_t instruction_ptr) {
   // Get Linux memory mapping from /proc/self/maps. Checking whether the
   // region the instruction pointer is in has executable permission can tell
   // whether it is in a valid code region. If there is no mapping for the
   // instruction pointer, it is indicative that the instruction pointer is
   // not within a module, which implies that it is outside a valid area.
   MinidumpLinuxMapsList *linux_maps_list = dump_->GetLinuxMapsList();
   const MinidumpLinuxMaps *linux_maps =
       linux_maps_list ?
       linux_maps_list->GetLinuxMapsForAddress(instruction_ptr) : NULL;
@@ skipping 36 matching lines @@
     case MD_EXCEPTION_CODE_LIN_DUMP_REQUESTED:
       return true;
       break;
     default:
       return false;
       break;
   }
 }
 
 }  // namespace google_breakpad