Index: src/processor/exploitability_linux.cc |
=================================================================== |
--- src/processor/exploitability_linux.cc (revision 1487) |
+++ src/processor/exploitability_linux.cc (working copy) |
@@ -124,7 +124,8 @@ |
// Checking for the instruction pointer in a valid instruction region. |
if (!this->InstructionPointerInCode(instruction_ptr) || |
- this->StackPointerOffStack(stack_ptr)) { |
+ this->StackPointerOffStack(stack_ptr) || |
+ this->ExecutableStackOrHeap()) { |
return EXPLOITABILITY_HIGH; |
} |
@@ -149,6 +150,24 @@ |
linux_maps->GetPathname().compare("[stack]")); |
} |
+bool ExploitabilityLinux::ExecutableStackOrHeap() { |
+ MinidumpLinuxMapsList *linux_maps_list = dump_->GetLinuxMapsList(); |
+ if (linux_maps_list) { |
+ for (size_t i = 0; i < linux_maps_list->get_maps_count(); i++) { |
+ const MinidumpLinuxMaps *linux_maps = |
+ linux_maps_list->GetLinuxMapsAtIndex(i); |
+ // Check for executable stack or heap for each mapping. |
+ if (linux_maps && |
+ (!linux_maps->GetPathname().compare("[stack]") || |
+ !linux_maps->GetPathname().compare("[heap]")) && |
+ linux_maps->IsExecutable()) { |
+ return true; |
+ } |
+ } |
+ } |
+ return false; |
+} |
+ |
bool ExploitabilityLinux::InstructionPointerInCode(uint64_t instruction_ptr) { |
// Get Linux memory mapping from /proc/self/maps. Checking whether the |
// region the instruction pointer is in has executable permission can tell |