Ensure no RWX pages remain after mach_override_ptr

third_party/mach_override/mach_override.c

Index: third_party/mach_override/mach_override.c
diff --git a/third_party/mach_override/mach_override.c b/third_party/mach_override/mach_override.c
index 549409d0b30b01a17c54d0f158773117a79a7e9f..5f668a4f2ac694ca021312c703eee436be974f77 100644
--- a/third_party/mach_override/mach_override.c
+++ b/third_party/mach_override/mach_override.c
@@ -156,7 +156,7 @@ mach_error_t makeIslandExecutable(void *address) {
 	mach_error_t err = err_none;
     uintptr_t page = (uintptr_t)address & ~(uintptr_t)(kPageSize-1);
     int e = err_none;
-    e |= mprotect((void *)page, kPageSize, PROT_EXEC | PROT_READ | PROT_WRITE);
+    e |= mprotect((void *)page, kPageSize, PROT_EXEC | PROT_READ);
     e |= msync((void *)page, kPageSize, MS_INVALIDATE );
     if (e) {
         err = err_cannot_override;
@@ -335,6 +335,10 @@ mach_override_ptr(
 #endif
 		if ( !err )
 			atomic_mov64((uint64_t *)originalFunctionPtr, jumpRelativeInstruction);
+	
+		err = vm_protect( mach_task_self(),
+				  (vm_address_t) originalFunctionPtr, 8, false,

[Mark Mentovai, 2013/07/30 22:01:53]

Assigning back into “err” after rewriting the original function’s code means
that if an error does occur here, the cleanup code below will free the
newly-written jump target.

Error handling in here is already a bit of a mess but you shouldn’t introduce
this new logic problem.

+				  (VM_PROT_READ | VM_PROT_EXECUTE) );    
 	}
 #endif