Verify acquired typed data: allow detection of use-after-free.

runtime/vm/dart_api_impl_test.cc

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "bin/builtin.h"
 #include "include/dart_api.h"
 #include "include/dart_debugger_api.h"
 #include "include/dart_mirrors_api.h"
 #include "include/dart_native_api.h"
 #include "platform/assert.h"
 #include "platform/json.h"
 #include "platform/utils.h"
 #include "vm/class_finalizer.h"
 #include "vm/dart_api_impl.h"
 #include "vm/dart_api_state.h"
 #include "vm/lockers.h"
 #include "vm/unit_test.h"
 #include "vm/verifier.h"
 
 namespace dart {
 
 DECLARE_FLAG(bool, enable_type_checks);
+DECLARE_FLAG(bool, verify_acquired_data);
 
 TEST_CASE(ErrorHandleBasics) {
   const char* kScriptChars =
       "void testMain() {\n"
       "  throw new Exception(\"bad news\");\n"
       "}\n";
 
   Dart_Handle lib = TestCase::LoadTestScript(kScriptChars, NULL);
 
   Dart_Handle instance = Dart_True();
@@ skipping 1701 matching lines @@
   result = Dart_Invoke(lib, NewString("main"), 0, NULL);
   EXPECT_VALID(result);
 
   for (intptr_t i = 0; i < kExtLength; i+=2) {
     EXPECT_EQ(0x24, data[i]);
     EXPECT_EQ(0x28, data[i+1]);
   }
 }
 
 
-TEST_CASE(TypedDataDirectAccess) {
+static void TestTypedDataDirectAccess() {
   Dart_Handle str = Dart_NewStringFromCString("junk");
   Dart_Handle byte_array = Dart_NewTypedData(Dart_TypedData_kUint8, 10);
   EXPECT_VALID(byte_array);
   Dart_Handle result;
   result = Dart_TypedDataAcquireData(byte_array, NULL, NULL, NULL);
   EXPECT_ERROR(result, "Dart_TypedDataAcquireData expects argument 'type'"
                        " to be non-null.");
   Dart_TypedData_Type type;
   result = Dart_TypedDataAcquireData(byte_array, &type, NULL, NULL);
   EXPECT_ERROR(result, "Dart_TypedDataAcquireData expects argument 'data'"
@@ skipping 12 matching lines @@
 
   result = Dart_TypedDataReleaseData(Dart_Null());
   EXPECT_ERROR(result, "Dart_TypedDataReleaseData expects argument 'object'"
                        " to be non-null.");
   result = Dart_TypedDataReleaseData(str);
   EXPECT_ERROR(result, "Dart_TypedDataReleaseData expects argument 'object'"
                        " to be of type 'TypedData'.");
 }
 
 
+TEST_CASE(TypedDataDirectAccessUnverified) {
+  FLAG_verify_acquired_data = false;
+  TestTypedDataDirectAccess();
+}
+
+
+TEST_CASE(TypedDataDirectAccessVerified) {
+  FLAG_verify_acquired_data = true;
+  TestTypedDataDirectAccess();
+}
+
+
 static void TestDirectAccess(Dart_Handle lib,
                              Dart_Handle array,
                              Dart_TypedData_Type expected_type) {
   Dart_Handle result;
 
   // Invoke the dart function that sets initial values.
   Dart_Handle dart_args[1];
   dart_args[0] = array;
   result = Dart_Invoke(lib, NewString("setMain"), 1, dart_args);
   EXPECT_VALID(result);
@@ skipping 21 matching lines @@
   // Release direct accesss to the typed data object.
   result = Dart_TypedDataReleaseData(array);
   EXPECT_VALID(result);
 
   // Invoke the dart function in order to check the modified values.
   result = Dart_Invoke(lib, NewString("testMain"), 1, dart_args);
   EXPECT_VALID(result);
 }
 
 
-TEST_CASE(TypedDataDirectAccess1) {
+static void TestTypedDataDirectAccess1() {
   const char* kScriptChars =
       "import 'dart:typed_data';\n"
       "class Expect {\n"
       "  static equals(a, b) {\n"
       "    if (a != b) {\n"
       "      throw new Exception('not equal. expected: $a, got: $b');\n"
       "    }\n"
       "  }\n"
       "}\n"
       "void setMain(var a) {"
@@ skipping 24 matching lines @@
   uint8_t data[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 };
   intptr_t data_length = ARRAY_SIZE(data);
   Dart_Handle ext_list_access_test_obj;
   ext_list_access_test_obj = Dart_NewExternalTypedData(Dart_TypedData_kUint8,
                                                        data, data_length);
   EXPECT_VALID(ext_list_access_test_obj);
   TestDirectAccess(lib, ext_list_access_test_obj, Dart_TypedData_kUint8);
 }
 
 
-TEST_CASE(TypedDataViewDirectAccess) {
+TEST_CASE(TypedDataDirectAccess1Unverified) {
+  FLAG_verify_acquired_data = false;
+  TestTypedDataDirectAccess1();
+}
+
+
+TEST_CASE(TypedDataDirectAccess1Verified) {
+  FLAG_verify_acquired_data = true;
+  TestTypedDataDirectAccess1();
+}
+
+
+static void TestTypedDataViewDirectAccess() {
   const char* kScriptChars =
       "import 'dart:typed_data';\n"
       "class Expect {\n"
       "  static equals(a, b) {\n"
       "    if (a != b) {\n"
       "      throw 'not equal. expected: $a, got: $b';\n"
       "    }\n"
       "  }\n"
       "}\n"
       "void setMain(var list) {"
@@ skipping 18 matching lines @@
   Dart_Handle lib = TestCase::LoadTestScript(kScriptChars, NULL);
 
   // Test with a typed data view object.
   Dart_Handle list_access_test_obj;
   list_access_test_obj = Dart_Invoke(lib, NewString("main"), 0, NULL);
   EXPECT_VALID(list_access_test_obj);
   TestDirectAccess(lib, list_access_test_obj, Dart_TypedData_kInt8);
 }
 
 
-TEST_CASE(ByteDataDirectAccess) {
+TEST_CASE(TypedDataViewDirectAccessUnverified) {
+  FLAG_verify_acquired_data = false;
+  TestTypedDataViewDirectAccess();
+}
+
+
+TEST_CASE(TypedDataViewDirectAccessVerified) {
+  FLAG_verify_acquired_data = true;
+  TestTypedDataViewDirectAccess();
+}
+
+
+static void TestByteDataDirectAccess() {
   const char* kScriptChars =
       "import 'dart:typed_data';\n"
       "class Expect {\n"
       "  static equals(a, b) {\n"
       "    if (a != b) {\n"
       "      throw 'not equal. expected: $a, got: $b';\n"
       "    }\n"
       "  }\n"
       "}\n"
       "void setMain(var list) {"
@@ skipping 18 matching lines @@
   Dart_Handle lib = TestCase::LoadTestScript(kScriptChars, NULL);
 
   // Test with a typed data view object.
   Dart_Handle list_access_test_obj;
   list_access_test_obj = Dart_Invoke(lib, NewString("main"), 0, NULL);
   EXPECT_VALID(list_access_test_obj);
   TestDirectAccess(lib, list_access_test_obj, Dart_TypedData_kByteData);
 }
 
 
+TEST_CASE(ByteDataDirectAccessUnverified) {
+  FLAG_verify_acquired_data = false;
+  TestByteDataDirectAccess();
+}
+
+
+TEST_CASE(ByteDataDirectAccessVerified) {
+  FLAG_verify_acquired_data = true;
+  TestByteDataDirectAccess();
+}
+
+
 static void ExternalTypedDataAccessTests(Dart_Handle obj,
                                          Dart_TypedData_Type expected_type,
                                          uint8_t data[],
                                          intptr_t data_length) {
   EXPECT_VALID(obj);
   EXPECT_EQ(expected_type, Dart_GetTypeOfExternalTypedData(obj));
   EXPECT(Dart_IsList(obj));
 
   void* raw_data = NULL;
   intptr_t len;
@@ skipping 6922 matching lines @@
     result = Dart_Invoke(lib,
                          NewString("testView16"),
                          1,
                          dart_args);
     EXPECT_VALID(result);
     EXPECT(Dart_IsString(result));
   }
 }
 
 }  // namespace dart