generic-library/bionic
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

_FORTIFY_SOURCE: check for integer overflows

Browse Source 
Ensure that strcat / strncat check for integer overflows
when computing the length of the resulting string.

Change-Id: Ib806ad33a0d3b50876f384bc17787a28f0dddc37
This commit is contained in:
Nick Kralevich
2012-06-07 16:30:02 -07:00
committed by Geremy Condra
parent f41855949d
commit 76656afc6d
3 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libc/Android.mk
View File

@@ -537,7 +537,8 @@ endif
libc_common_c_includes := \ libc_common_c_includes := \
$(LOCAL_PATH)/stdlib \ $(LOCAL_PATH)/stdlib \
$(LOCAL_PATH)/string \ $(LOCAL_PATH)/string \
$(LOCAL_PATH)/stdio $(LOCAL_PATH)/stdio \
external/safe-iop/include
# Needed to access private/__dso_handle.h from # Needed to access private/__dso_handle.h from
# crtbegin_xxx.S and crtend_xxx.S # crtbegin_xxx.S and crtend_xxx.S

7
libc/string/__strcat_chk.c
View File

@@ -29,6 +29,7 @@
#include <string.h> #include <string.h>
#include <stdlib.h> #include <stdlib.h>
#include <private/logd.h> #include <private/logd.h>
#include <safe_iop.h>
/* /*
* Runtime implementation of __builtin____strcat_chk. * Runtime implementation of __builtin____strcat_chk.
@@ -46,8 +47,12 @@ char *__strcat_chk (char *dest, const char *src, size_t dest_buf_size)
// TODO: optimize so we don't scan src/dest twice. // TODO: optimize so we don't scan src/dest twice.
size_t src_len = strlen(src); size_t src_len = strlen(src);
size_t dest_len = strlen(dest); size_t dest_len = strlen(dest);
size_t sum;
if (src_len + dest_len + 1 > dest_buf_size) { // sum = src_len + dest_len + 1 (with overflow protection)
if (!safe_add3(&sum, src_len, dest_len, 1U)) abort();
if (sum > dest_buf_size) {
__libc_android_log_print(ANDROID_LOG_FATAL, "libc", __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
"*** strcat buffer overflow detected ***\n"); "*** strcat buffer overflow detected ***\n");
abort(); abort();

7
libc/string/__strncat_chk.c
View File

@@ -29,6 +29,7 @@
#include <string.h> #include <string.h>
#include <stdlib.h> #include <stdlib.h>
#include <private/logd.h> #include <private/logd.h>
#include <safe_iop.h>
/* /*
* Runtime implementation of __builtin____strncat_chk. * Runtime implementation of __builtin____strncat_chk.
@@ -51,7 +52,11 @@ char *__strncat_chk (char *dest, const char *src,
src_len = len; src_len = len;
} }
if (dest_len + src_len + 1 > dest_buf_size) { size_t sum;
// sum = src_len + dest_len + 1 (with overflow protection)
if (!safe_add3(&sum, src_len, dest_len, 1U)) abort();
if (sum > dest_buf_size) {
__libc_android_log_print(ANDROID_LOG_FATAL, "libc", __libc_android_log_print(ANDROID_LOG_FATAL, "libc",
"*** strncat buffer overflow detected ***\n"); "*** strncat buffer overflow detected ***\n");
abort(); abort();