OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <fcntl.h> | 5 #include <fcntl.h> |
6 #include <stdio.h> | 6 #include <stdio.h> |
7 #include <stdlib.h> | 7 #include <stdlib.h> |
8 #include <string.h> | 8 #include <string.h> |
9 #include <sys/stat.h> | 9 #include <sys/stat.h> |
10 #include <sys/types.h> | 10 #include <sys/types.h> |
11 | 11 |
12 #include <algorithm> | 12 #include <algorithm> |
13 #include <limits> | 13 #include <limits> |
14 | 14 |
15 #include "base/files/file_util.h" | 15 #include "base/files/file_util.h" |
16 #include "base/logging.h" | 16 #include "base/logging.h" |
17 #include "base/memory/scoped_ptr.h" | 17 #include "base/memory/scoped_ptr.h" |
18 #include "build/build_config.h" | 18 #include "build/build_config.h" |
19 #include "testing/gtest/include/gtest/gtest.h" | 19 #include "testing/gtest/include/gtest/gtest.h" |
20 | 20 |
21 #if defined(OS_POSIX) | 21 #if defined(OS_POSIX) |
22 #include <sys/mman.h> | 22 #include <sys/mman.h> |
23 #include <unistd.h> | 23 #include <unistd.h> |
24 #endif | 24 #endif |
25 | 25 |
26 #if defined(OS_WIN) | |
27 #include <new.h> | |
28 #endif | |
29 | |
30 using std::nothrow; | 26 using std::nothrow; |
31 using std::numeric_limits; | 27 using std::numeric_limits; |
32 | 28 |
33 namespace { | 29 namespace { |
34 | 30 |
35 #if defined(OS_WIN) | |
36 // This is a permitted size but exhausts memory pretty quickly. | |
37 const size_t kLargePermittedAllocation = 0x7FFFE000; | |
38 | |
39 int OnNoMemory(size_t) { | |
40 _exit(1); | |
41 } | |
42 | |
43 void ExhaustMemoryWithMalloc() { | |
44 for (;;) { | |
45 // Without the |volatile|, clang optimizes away the allocation. | |
46 void* volatile buf = malloc(kLargePermittedAllocation); | |
47 if (!buf) | |
48 break; | |
49 } | |
50 } | |
51 | |
52 void ExhaustMemoryWithRealloc() { | |
53 size_t size = kLargePermittedAllocation; | |
54 void* buf = malloc(size); | |
55 if (!buf) | |
56 return; | |
57 for (;;) { | |
58 size += kLargePermittedAllocation; | |
59 void* new_buf = realloc(buf, size); | |
60 if (!buf) | |
61 break; | |
62 buf = new_buf; | |
63 } | |
64 } | |
65 #endif | |
66 | |
67 // This function acts as a compiler optimization barrier. We use it to | 31 // This function acts as a compiler optimization barrier. We use it to |
68 // prevent the compiler from making an expression a compile-time constant. | 32 // prevent the compiler from making an expression a compile-time constant. |
69 // We also use it so that the compiler doesn't discard certain return values | 33 // We also use it so that the compiler doesn't discard certain return values |
70 // as something we don't need (see the comment with calloc below). | 34 // as something we don't need (see the comment with calloc below). |
71 template <typename Type> | 35 template <typename Type> |
72 NOINLINE Type HideValueFromCompiler(volatile Type value) { | 36 NOINLINE Type HideValueFromCompiler(volatile Type value) { |
73 #if defined(__GNUC__) | 37 #if defined(__GNUC__) |
74 // In a GCC compatible compiler (GCC or Clang), make this compiler barrier | 38 // In a GCC compatible compiler (GCC or Clang), make this compiler barrier |
75 // more robust than merely using "volatile". | 39 // more robust than merely using "volatile". |
76 __asm__ volatile ("" : "+r" (value)); | 40 __asm__ volatile ("" : "+r" (value)); |
(...skipping 56 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
133 // crbug.com/169327. | 97 // crbug.com/169327. |
134 | 98 |
135 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsMalloc)) { | 99 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsMalloc)) { |
136 if (!IsTcMallocBypassed()) { | 100 if (!IsTcMallocBypassed()) { |
137 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( | 101 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( |
138 HideValueFromCompiler(malloc(kTooBigAllocSize)))); | 102 HideValueFromCompiler(malloc(kTooBigAllocSize)))); |
139 ASSERT_TRUE(!ptr); | 103 ASSERT_TRUE(!ptr); |
140 } | 104 } |
141 } | 105 } |
142 | 106 |
143 #if defined(GTEST_HAS_DEATH_TEST) && defined(OS_WIN) | |
144 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationMallocDeathTest)) { | |
145 _set_new_handler(&OnNoMemory); | |
146 _set_new_mode(1); | |
147 { | |
148 scoped_ptr<char, base::FreeDeleter> ptr; | |
149 EXPECT_DEATH(ptr.reset(static_cast<char*>( | |
150 HideValueFromCompiler(malloc(kTooBigAllocSize)))), | |
151 ""); | |
152 ASSERT_TRUE(!ptr); | |
153 } | |
154 _set_new_handler(NULL); | |
155 _set_new_mode(0); | |
156 } | |
157 | |
158 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationExhaustDeathTest)) { | |
159 _set_new_handler(&OnNoMemory); | |
160 _set_new_mode(1); | |
161 { | |
162 ASSERT_DEATH(ExhaustMemoryWithMalloc(), ""); | |
163 } | |
164 _set_new_handler(NULL); | |
165 _set_new_mode(0); | |
166 } | |
167 | |
168 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryReallocationExhaustDeathTest)) { | |
169 _set_new_handler(&OnNoMemory); | |
170 _set_new_mode(1); | |
171 { | |
172 ASSERT_DEATH(ExhaustMemoryWithRealloc(), ""); | |
173 } | |
174 _set_new_handler(NULL); | |
175 _set_new_mode(0); | |
176 } | |
177 #endif | |
178 | |
179 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsCalloc)) { | 107 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsCalloc)) { |
180 if (!IsTcMallocBypassed()) { | 108 if (!IsTcMallocBypassed()) { |
181 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( | 109 scoped_ptr<char, base::FreeDeleter> ptr(static_cast<char*>( |
182 HideValueFromCompiler(calloc(kTooBigAllocSize, 1)))); | 110 HideValueFromCompiler(calloc(kTooBigAllocSize, 1)))); |
183 ASSERT_TRUE(!ptr); | 111 ASSERT_TRUE(!ptr); |
184 } | 112 } |
185 } | 113 } |
186 | 114 |
187 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsRealloc)) { | 115 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsRealloc)) { |
188 if (!IsTcMallocBypassed()) { | 116 if (!IsTcMallocBypassed()) { |
(...skipping 12 matching lines...) Expand all Loading... |
201 } VeryLargeStruct; | 129 } VeryLargeStruct; |
202 | 130 |
203 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNew)) { | 131 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNew)) { |
204 if (!IsTcMallocBypassed()) { | 132 if (!IsTcMallocBypassed()) { |
205 scoped_ptr<VeryLargeStruct> ptr( | 133 scoped_ptr<VeryLargeStruct> ptr( |
206 HideValueFromCompiler(new (nothrow) VeryLargeStruct)); | 134 HideValueFromCompiler(new (nothrow) VeryLargeStruct)); |
207 ASSERT_TRUE(!ptr); | 135 ASSERT_TRUE(!ptr); |
208 } | 136 } |
209 } | 137 } |
210 | 138 |
211 #if defined(GTEST_HAS_DEATH_TEST) && defined(OS_WIN) | |
212 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationNewDeathTest)) { | |
213 _set_new_handler(&OnNoMemory); | |
214 { | |
215 scoped_ptr<VeryLargeStruct> ptr; | |
216 EXPECT_DEATH( | |
217 ptr.reset(HideValueFromCompiler(new (nothrow) VeryLargeStruct)), ""); | |
218 ASSERT_TRUE(!ptr); | |
219 } | |
220 _set_new_handler(NULL); | |
221 } | |
222 #endif | |
223 | |
224 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNewArray)) { | 139 TEST(SecurityTest, MALLOC_OVERFLOW_TEST(MemoryAllocationRestrictionsNewArray)) { |
225 if (!IsTcMallocBypassed()) { | 140 if (!IsTcMallocBypassed()) { |
226 scoped_ptr<char[]> ptr( | 141 scoped_ptr<char[]> ptr( |
227 HideValueFromCompiler(new (nothrow) char[kTooBigAllocSize])); | 142 HideValueFromCompiler(new (nothrow) char[kTooBigAllocSize])); |
228 ASSERT_TRUE(!ptr); | 143 ASSERT_TRUE(!ptr); |
229 } | 144 } |
230 } | 145 } |
231 | 146 |
232 // The tests bellow check for overflows in new[] and calloc(). | 147 // The tests bellow check for overflows in new[] and calloc(). |
233 | 148 |
234 // There are platforms where these tests are known to fail. We would like to | 149 // There are platforms where these tests are known to fail. We would like to |
235 // be able to easily check the status on the bots, but marking tests as | 150 // be able to easily check the status on the bots, but marking tests as |
236 // FAILS_ is too clunky. | 151 // FAILS_ is too clunky. |
237 void OverflowTestsSoftExpectTrue(bool overflow_detected) { | 152 void OverflowTestsSoftExpectTrue(bool overflow_detected) { |
238 if (!overflow_detected) { | 153 if (!overflow_detected) { |
239 #if defined(OS_LINUX) || defined(OS_ANDROID) || defined(OS_MACOSX) | 154 #if defined(OS_LINUX) || defined(OS_ANDROID) || defined(OS_MACOSX) |
240 // Sadly, on Linux, Android, and OSX we don't have a good story yet. Don't | 155 // Sadly, on Linux, Android, and OSX we don't have a good story yet. Don't |
241 // fail the test, but report. | 156 // fail the test, but report. |
242 printf("Platform has overflow: %s\n", | 157 printf("Platform has overflow: %s\n", |
243 !overflow_detected ? "yes." : "no."); | 158 !overflow_detected ? "yes." : "no."); |
244 #else | 159 #else |
245 // Otherwise, fail the test. (Note: EXPECT are ok in subfunctions, ASSERT | 160 // Otherwise, fail the test. (Note: EXPECT are ok in subfunctions, ASSERT |
246 // aren't). | 161 // aren't). |
247 EXPECT_TRUE(overflow_detected); | 162 EXPECT_TRUE(overflow_detected); |
248 #endif | 163 #endif |
249 } | 164 } |
250 } | 165 } |
251 | 166 |
252 #if defined(OS_IOS) || defined(OS_WIN) || defined(THREAD_SANITIZER) || defined(O
S_MACOSX) | 167 #if defined(OS_IOS) || defined(THREAD_SANITIZER) || defined(OS_MACOSX) |
253 #define MAYBE_NewOverflow DISABLED_NewOverflow | 168 #define MAYBE_NewOverflow DISABLED_NewOverflow |
254 #else | 169 #else |
255 #define MAYBE_NewOverflow NewOverflow | 170 #define MAYBE_NewOverflow NewOverflow |
256 #endif | 171 #endif |
257 // Test array[TooBig][X] and array[X][TooBig] allocations for int overflows. | 172 // Test array[TooBig][X] and array[X][TooBig] allocations for int overflows. |
258 // IOS doesn't honor nothrow, so disable the test there. | 173 // IOS doesn't honor nothrow, so disable the test there. |
259 // Crashes on Windows Dbg builds, disable there as well. | 174 // Crashes on Windows Dbg builds, disable there as well. |
260 // Fails on Mac 10.8 http://crbug.com/227092 | 175 // Fails on Mac 10.8 http://crbug.com/227092 |
261 TEST(SecurityTest, MAYBE_NewOverflow) { | 176 TEST(SecurityTest, MAYBE_NewOverflow) { |
262 const size_t kArraySize = 4096; | 177 const size_t kArraySize = 4096; |
263 // We want something "dynamic" here, so that the compiler doesn't | 178 // We want something "dynamic" here, so that the compiler doesn't |
264 // immediately reject crazy arrays. | 179 // immediately reject crazy arrays. |
265 const size_t kDynamicArraySize = HideValueFromCompiler(kArraySize); | 180 const size_t kDynamicArraySize = HideValueFromCompiler(kArraySize); |
266 // numeric_limits are still not constexpr until we switch to C++11, so we | 181 // numeric_limits are still not constexpr until we switch to C++11, so we |
267 // use an ugly cast. | 182 // use an ugly cast. |
268 const size_t kMaxSizeT = ~static_cast<size_t>(0); | 183 const size_t kMaxSizeT = ~static_cast<size_t>(0); |
269 ASSERT_EQ(numeric_limits<size_t>::max(), kMaxSizeT); | 184 ASSERT_EQ(numeric_limits<size_t>::max(), kMaxSizeT); |
270 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; | 185 const size_t kArraySize2 = kMaxSizeT / kArraySize + 10; |
271 const size_t kDynamicArraySize2 = HideValueFromCompiler(kArraySize2); | 186 const size_t kDynamicArraySize2 = HideValueFromCompiler(kArraySize2); |
272 { | 187 { |
273 scoped_ptr<char[][kArraySize]> array_pointer(new (nothrow) | 188 scoped_ptr<char[][kArraySize]> array_pointer(new (nothrow) |
274 char[kDynamicArraySize2][kArraySize]); | 189 char[kDynamicArraySize2][kArraySize]); |
275 OverflowTestsSoftExpectTrue(!array_pointer); | 190 OverflowTestsSoftExpectTrue(!array_pointer); |
276 } | 191 } |
277 // On windows, the compiler prevents static array sizes of more than | |
278 // 0x7fffffff (error C2148). | |
279 #if defined(OS_WIN) && defined(ARCH_CPU_64_BITS) | |
280 ALLOW_UNUSED_LOCAL(kDynamicArraySize); | |
281 #else | |
282 { | 192 { |
283 scoped_ptr<char[][kArraySize2]> array_pointer(new (nothrow) | 193 scoped_ptr<char[][kArraySize2]> array_pointer(new (nothrow) |
284 char[kDynamicArraySize][kArraySize2]); | 194 char[kDynamicArraySize][kArraySize2]); |
285 OverflowTestsSoftExpectTrue(!array_pointer); | 195 OverflowTestsSoftExpectTrue(!array_pointer); |
286 } | 196 } |
287 #endif // !defined(OS_WIN) || !defined(ARCH_CPU_64_BITS) | |
288 } | 197 } |
289 | 198 |
290 // Call calloc(), eventually free the memory and return whether or not | 199 // Call calloc(), eventually free the memory and return whether or not |
291 // calloc() did succeed. | 200 // calloc() did succeed. |
292 bool CallocReturnsNull(size_t nmemb, size_t size) { | 201 bool CallocReturnsNull(size_t nmemb, size_t size) { |
293 scoped_ptr<char, base::FreeDeleter> array_pointer( | 202 scoped_ptr<char, base::FreeDeleter> array_pointer( |
294 static_cast<char*>(calloc(nmemb, size))); | 203 static_cast<char*>(calloc(nmemb, size))); |
295 // We need the call to HideValueFromCompiler(): we have seen LLVM | 204 // We need the call to HideValueFromCompiler(): we have seen LLVM |
296 // optimize away the call to calloc() entirely and assume the pointer to not | 205 // optimize away the call to calloc() entirely and assume the pointer to not |
297 // be NULL. | 206 // be NULL. |
(...skipping 69 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
367 // kRandomMask, so we use it as an additional detection mechanism. | 276 // kRandomMask, so we use it as an additional detection mechanism. |
368 const uintptr_t kRandomMask = 0x3fffffffffffULL; | 277 const uintptr_t kRandomMask = 0x3fffffffffffULL; |
369 bool impossible_random_address = | 278 bool impossible_random_address = |
370 reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; | 279 reinterpret_cast<uintptr_t>(ptr.get()) & ~kRandomMask; |
371 EXPECT_FALSE(impossible_random_address); | 280 EXPECT_FALSE(impossible_random_address); |
372 } | 281 } |
373 | 282 |
374 #endif // defined(OS_LINUX) && defined(__x86_64__) | 283 #endif // defined(OS_LINUX) && defined(__x86_64__) |
375 | 284 |
376 } // namespace | 285 } // namespace |
OLD | NEW |