| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <fcntl.h> | 5 #include <fcntl.h> |
| 6 #include <stdio.h> | 6 #include <stdio.h> |
| 7 #include <stdlib.h> | 7 #include <stdlib.h> |
| 8 #include <string.h> | 8 #include <string.h> |
| 9 #include <sys/stat.h> | 9 #include <sys/stat.h> |
| 10 #include <sys/types.h> | 10 #include <sys/types.h> |
| 11 | 11 |
| 12 #include <algorithm> | 12 #include <algorithm> |
| 13 #include <limits> | 13 #include <limits> |
| 14 | 14 |
| 15 #include "base/files/file_util.h" | 15 #include "base/files/file_util.h" |
| 16 #include "base/logging.h" | 16 #include "base/logging.h" |
| 17 #include "base/memory/scoped_ptr.h" | 17 #include "base/memory/scoped_ptr.h" |
| 18 #include "build/build_config.h" | 18 #include "build/build_config.h" |
| 19 #include "testing/gtest/include/gtest/gtest.h" | 19 #include "testing/gtest/include/gtest/gtest.h" |
| 20 | 20 |
| 21 #if defined(OS_POSIX) | 21 #if defined(OS_POSIX) |
| 22 #include <sys/mman.h> | 22 #include <sys/mman.h> |
| 23 #include <unistd.h> | 23 #include <unistd.h> |
| 24 #endif | 24 #endif |
| 25 | 25 |
| 26 #if defined(OS_WIN) | |
| 27 #include <new.h> | |
| 28 #endif | |
| 29 | |
| 30 using std::nothrow; | 26 using std::nothrow; |
| 31 using std::numeric_limits; | 27 using std::numeric_limits; |
| 32 | 28 |
| 33 namespace { | 29 namespace { |
| 34 | 30 |
| 35 #if defined(OS_WIN) | |
| 36 // This is a permitted size but exhausts memory pretty quickly. | |
| 37 const size_t kLargePermittedAllocation = 0x7FFFE000; | |
| 38 | |
| 39 int OnNoMemory(size_t) { | |
| 40 _exit(1); | |
| 41 } | |
| 42 | |
| 43 void ExhaustMemoryWithMalloc() { | |
| 44 for (;;) { | |
| 45 // Without the |volatile|, clang optimizes away the allocation. | |
| 46 void* volatile buf = malloc(kLargePermittedAllocation); | |
| 47 if (!buf) | |
| 48 break; | |
| 49 } | |
| 50 } | |
| 51 | |
| 52 void ExhaustMemoryWithRealloc() { | |
| 53 size_t size = kLargePermittedAllocation; | |
| 54 void* buf = malloc(size); | |
| 55 if (!buf) | |
| 56 return; | |
| 57 for (;;) { | |
| 58 size += kLargePermittedAllocation; | |
| 59 void* new_buf = realloc(buf, size); | |
| 60 if (!buf) | |
| 61 break; | |
| 62 buf = new_buf; | |
| 63 } | |
| 64 } | |
| 65 #endif | |
| 66 | |
| 67 // This function acts as a compiler optimization barrier. We use it to | 31 // This function acts as a compiler optimization barrier. We use it to |
| 68 // prevent the compiler from making an expression a compile-time constant. | 32 // prevent the compiler from making an expression a compile-time constant. |
| 69 // We also use it so that the compiler doesn't discard certain return values | 33 // We also use it so that the compiler doesn't discard certain return values |
| 70 // as something we don't need (see the comment with calloc below). | 34 // as something we don't need (see the comment with calloc below). |
| 71 template <typename Type> | 35 template <typename Type> |
| 72 NOINLINE Type HideValueFromCompiler(volatile Type value) { | 36 NOINLINE Type HideValueFromCompiler(volatile Type value) { |
| 73 #if defined(__GNUC__) | 37 #if defined(__GNUC__) |
| 74 // In a GCC compatible compiler (GCC or Clang), make this compiler barrier | 38 // In a GCC compatible compiler (GCC or Clang), make this compiler barrier |
| 75 // more robust than merely using "volatile". | 39 // more robust than merely using "volatile". |
| 76 __asm__ volatile ("" : "+r" (value)); | 40 __asm__ volatile ("" : "+r" (value)); |
| (...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 133 // crbug.com/169327. | 97 // crbug.com/169327. |
| 134 | 98 |
| 135 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsMalloc)) { | 99 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsMalloc)) { |
| 136 if (!IsTcMallocBypassed()) { | 100 if (!IsTcMallocBypassed()) { |
| 137 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( | 101 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( |
| 138 HideValueFromCompiler(malloc(kTooBigAllocSize)))); | 102 HideValueFromCompiler(malloc(kTooBigAllocSize)))); |
| 139 ASSERT_TRUE(!ptr); | 103 ASSERT_TRUE(!ptr); |
| 140 } | 104 } |
| 141 } | 105 } |
| 142 | 106 |
| 143 #if defined(GTEST_HAS_DEATH_TEST) && defined(OS_WIN) | |
| 144 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationMallocDeathTest)) { | |
| 145 _set_new_handler(&OnNoMemory); | |
| 146 _set_new_mode(1); | |
| 147 { | |
| 148 scoped_ptr<char, base::FreeDeleter> ptr; | |
| 149 EXPECT_DEATH(ptr.reset(static_cast<char*>( | |
| 150 HideValueFromCompiler(malloc(kTooBigAllocSize)))), | |
| 151 ""); | |
| 152 ASSERT_TRUE(!ptr); | |
| 153 } | |
| 154 _set_new_handler(NULL); | |
| 155 _set_new_mode(0); | |
| 156 } | |
| 157 | |
| 158 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationExhaustDeathTest)) { | |
| 159 _set_new_handler(&OnNoMemory); | |
| 160 _set_new_mode(1); | |
| 161 { | |
| 162 ASSERT_DEATH(ExhaustMemoryWithMalloc(), ""); | |
| 163 } | |
| 164 _set_new_handler(NULL); | |
| 165 _set_new_mode(0); | |
| 166 } | |
| 167 | |
| 168 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryReallocationExhaustDeathTest)) { | |
| 169 _set_new_handler(&OnNoMemory); | |
| 170 _set_new_mode(1); | |
| 171 { | |
| 172 ASSERT_DEATH(ExhaustMemoryWithRealloc(), ""); | |
| 173 } | |
| 174 _set_new_handler(NULL); | |
| 175 _set_new_mode(0); | |
| 176 } | |
| 177 #endif | |
| 178 | |
| 179 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsCalloc)) { | 107 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsCalloc)) { |
| 180 if (!IsTcMallocBypassed()) { | 108 if (!IsTcMallocBypassed()) { |
| 181 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( | 109 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( |
| 182 HideValueFromCompiler(calloc(kTooBigAllocSize, 1)))); | 110 HideValueFromCompiler(calloc(kTooBigAllocSize, 1)))); |
| 183 ASSERT_TRUE(!ptr); | 111 ASSERT_TRUE(!ptr); |
| 184 } | 112 } |
| 185 } | 113 } |
| 186 | 114 |
| 187 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsRealloc)) { | 115 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsRealloc)) { |
| 188 if (!IsTcMallocBypassed()) { | 116 if (!IsTcMallocBypassed()) { |
| (...skipping 12 matching lines...) Expand all Loading... |
| 201 } VeryLargeStruct; | 129 } VeryLargeStruct; |
| 202 | 130 |
| 203 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNew)) { | 131 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNew)) { |
| 204 if (!IsTcMallocBypassed()) { | 132 if (!IsTcMallocBypassed()) { |
| 205 scoped_ptr<VeryLargeStruct> ptr( | 133 scoped_ptr<VeryLargeStruct> ptr( |
| 206 HideValueFromCompiler(new (nothrow) VeryLargeStruct)); | 134 HideValueFromCompiler(new (nothrow) VeryLargeStruct)); |
| 207 ASSERT_TRUE(!ptr); | 135 ASSERT_TRUE(!ptr); |
| 208 } | 136 } |
| 209 } | 137 } |
| 210 | 138 |
| 211 #if defined(GTEST_HAS_DEATH_TEST) && defined(OS_WIN) | |
| 212 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationNewDeathTest)) { | |
| 213 _set_new_handler(&OnNoMemory); | |
| 214 { | |
| 215 scoped_ptr<VeryLargeStruct> ptr; | |
| 216 EXPECT_DEATH( | |
| 217 ptr.reset(HideValueFromCompiler(new (nothrow) VeryLargeStruct)), ""); | |
| 218 ASSERT_TRUE(!ptr); | |
| 219 } | |
| 220 _set_new_handler(NULL); | |
| 221 } | |
| 222 #endif | |
| 223 | |
| 224 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNewArray)) { | 139 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNewArray)) { |
| 225 if (!IsTcMallocBypassed()) { | 140 if (!IsTcMallocBypassed()) { |
| 226 scoped_ptr<char[]> ptr( | 141 scoped_ptr<char[]> ptr( |
| 227 HideValueFromCompiler(new (nothrow) char[kTooBigAllocSize])); | 142 HideValueFromCompiler(new (nothrow) char[kTooBigAllocSize])); |
| 228 ASSERT_TRUE(!ptr); | 143 ASSERT_TRUE(!ptr); |
| 229 } | 144 } |
| 230 } | 145 } |
| 231 | 146 |
| 232 // The tests bellow check for overflows in new[] and calloc(). | 147 // The tests bellow check for overflows in new[] and calloc(). |
| 233 | 148 |
| 234 // There are platforms where these tests are known to fail. We would like to | 149 // There are platforms where these tests are known to fail. We would like to |
| 235 // be able to easily check the status on the bots, but marking tests as | 150 // be able to easily check the status on the bots, but marking tests as |
| 236 // FAILS_ is too clunky. | 151 // FAILS_ is too clunky. |
| 237 void OverflowTestsSoftExpectTrue(bool overflow_detected) { | 152 void OverflowTestsSoftExpectTrue(bool overflow_detected) { |
| 238 if (!overflow_detected) { | 153 if (!overflow_detected) { |
| 239 #if defined(OS_LINUX) || defined(OS_ANDROID) || defined(OS_MACOSX) | 154 #if defined(OS_LINUX) || defined(OS_ANDROID) || defined(OS_MACOSX) |
| 240 // Sadly, on Linux, Android, and OSX we don't have a good story yet. Don't | 155 // Sadly, on Linux, Android, and OSX we don't have a good story yet. Don't |
| 241 // fail the test, but report. | 156 // fail the test, but report. |
| 242 printf("Platform has overflow: %s\n", | 157 printf("Platform has overflow: %s\n", |
| 243 !overflow_detected ? "yes." : "no."); | 158 !overflow_detected ? "yes." : "no."); |
| 244 #else | 159 #else |
| 245 // Otherwise, fail the test. (Note: EXPECT are ok in subfunctions, ASSERT | 160 // Otherwise, fail the test. (Note: EXPECT are ok in subfunctions, ASSERT |
| 246 // aren't). | 161 // aren't). |
| 247 EXPECT_TRUE(overflow_detected); | 162 EXPECT_TRUE(overflow_detected); |
| 248 #endif | 163 #endif |
| 249 } | 164 } |
| 250 } | 165 } |
| 251 | 166 |
| 252 #if defined(OS_IOS) || defined(OS_WIN) || defined(THREAD_SANITIZER) || defined(O
S_MACOSX) | 167 #if defined(OS_IOS) || defined(THREAD_SANITIZER) || defined(OS_MACOSX) |
| 253 #define MAYBE_NewOverflow DISABLED_NewOverflow | 168 #define MAYBE_NewOverflow DISABLED_NewOverflow |
| 254 #else | 169 #else |
| 255 #define MAYBE_NewOverflow NewOverflow | 170 #define MAYBE_NewOverflow NewOverflow |
| 256 #endif | 171 #endif |
| 257 // Test array[TooBig][X] and array[X][TooBig] allocations for int overflows. | 172 // Test array[TooBig][X] and array[X][TooBig] allocations for int overflows. |
| 258 // IOS doesn't honor nothrow, so disable the test there. | 173 // IOS doesn't honor nothrow, so disable the test there. |
| 259 // Crashes on Windows Dbg builds, disable there as well. | 174 // Crashes on Windows Dbg builds, disable there as well. |
| 260 // Fails on Mac 10.8 http://crbug.com/227092 | 175 // Fails on Mac 10.8 http://crbug.com/227092 |
| 261 TEST(SecurityTest, MAYBE_NewOverflow) { | 176 TEST(SecurityTest, MAYBE_NewOverflow) { |
| 262 const size_t kArraySize = 4096; | 177 const size_t kArraySize = 4096; |
| 263 // We want something "dynamic" here, so that the compiler doesn't | 178 // We want something "dynamic" here, so that the compiler doesn't |
| 264 // immediately reject crazy arrays. | 179 // immediately reject crazy arrays. |
| 265 const size_t kDynamicArraySize = HideValueFromCompiler(kArraySize); | 180 const size_t kDynamicArraySize = HideValueFromCompiler(kArraySize); |
| 266 // numeric_limits are still not constexpr until we switch to C++11, so we | 181 // numeric_limits are still not constexpr until we switch to C++11, so we |
| 267 // use an ugly cast. | 182 // use an ugly cast. |
| 268 const size_t kMaxSizeT = ~static_cast<size_t>(0); | 183 const size_t kMaxSizeT = ~static_cast<size_t>(0); |
| 269 ASSERT_EQ(numeric_limits<size_t>::max(), kMaxSizeT); | 184 ASSERT_EQ(numeric_limits<size_t>::max(), kMaxSizeT); |
| 270 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; | 185 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; |
| 271 const size_t kDynamicArraySize2 = HideValueFromCompiler(kArraySize2); | 186 const size_t kDynamicArraySize2 = HideValueFromCompiler(kArraySize2); |
| 272 { | 187 { |
| 273 scoped_ptr<char[][kArraySize]> array_pointer(new (nothrow) | 188 scoped_ptr<char[][kArraySize]> array_pointer(new (nothrow) |
| 274 char[kDynamicArraySize2][kArraySize]); | 189 char[kDynamicArraySize2][kArraySize]); |
| 275 OverflowTestsSoftExpectTrue(!array_pointer); | 190 OverflowTestsSoftExpectTrue(!array_pointer); |
| 276 } | 191 } |
| 277 // On windows, the compiler prevents static array sizes of more than | |
| 278 // 0x7fffffff (error C2148). | |
| 279 #if defined(OS_WIN) && defined(ARCH_CPU_64_BITS) | |
| 280 ALLOW_UNUSED_LOCAL(kDynamicArraySize); | |
| 281 #else | |
| 282 { | 192 { |
| 283 scoped_ptr<char[][kArraySize2]> array_pointer(new (nothrow) | 193 scoped_ptr<char[][kArraySize2]> array_pointer(new (nothrow) |
| 284 char[kDynamicArraySize][kArraySize2]); | 194 char[kDynamicArraySize][kArraySize2]); |
| 285 OverflowTestsSoftExpectTrue(!array_pointer); | 195 OverflowTestsSoftExpectTrue(!array_pointer); |
| 286 } | 196 } |
| 287 #endif // !defined(OS_WIN) || !defined(ARCH_CPU_64_BITS) | |
| 288 } | 197 } |
| 289 | 198 |
| 290 // Call calloc(), eventually free the memory and return whether or not | 199 // Call calloc(), eventually free the memory and return whether or not |
| 291 // calloc() did succeed. | 200 // calloc() did succeed. |
| 292 bool CallocReturnsNull(size_t nmemb, size_t size) { | 201 bool CallocReturnsNull(size_t nmemb, size_t size) { |
| 293 scoped_ptr<char, base::FreeDeleter> array_pointer( | 202 scoped_ptr<char, base::FreeDeleter> array_pointer( |
| 294 static_cast<char*>(calloc(nmemb, size))); | 203 static_cast<char*>(calloc(nmemb, size))); |
| 295 // We need the call to HideValueFromCompiler(): we have seen LLVM | 204 // We need the call to HideValueFromCompiler(): we have seen LLVM |
| 296 // optimize away the call to calloc() entirely and assume the pointer to not | 205 // optimize away the call to calloc() entirely and assume the pointer to not |
| 297 // be NULL. | 206 // be NULL. |
| (...skipping 69 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 367 // kRandomMask, so we use it as an additional detection mechanism. | 276 // kRandomMask, so we use it as an additional detection mechanism. |
| 368 const uintptr_t kRandomMask = 0x3fffffffffffULL; | 277 const uintptr_t kRandomMask = 0x3fffffffffffULL; |
| 369 bool impossible_random_address = | 278 bool impossible_random_address = |
| 370 reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; | 279 reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; |
| 371 EXPECT_FALSE(impossible_random_address); | 280 EXPECT_FALSE(impossible_random_address); |
| 372 } | 281 } |
| 373 | 282 |
| 374 #endif // defined(OS_LINUX) && defined(__x86_64__) | 283 #endif // defined(OS_LINUX) && defined(__x86_64__) |
| 375 | 284 |
| 376 } // namespace | 285 } // namespace |
| OLD | NEW |