diff --git a/libc/Android.mk b/libc/Android.mk index c50745711..f90520edd 100644 --- a/libc/Android.mk +++ b/libc/Android.mk @@ -141,7 +141,9 @@ libc_common_src_files := \ stdio/wbuf.c \ stdio/wsetup.c \ stdio/__snprintf_chk.c \ + stdio/__sprintf_chk.c \ stdio/__vsnprintf_chk.c \ + stdio/__vsprintf_chk.c \ stdlib/_rand48.c \ stdlib/assert.c \ stdlib/atexit.c \ diff --git a/libc/include/stdio.h b/libc/include/stdio.h index cc3270d81..18b19bf7c 100644 --- a/libc/include/stdio.h +++ b/libc/include/stdio.h @@ -231,12 +231,16 @@ int fgetc(FILE *); int fgetpos(FILE *, fpos_t *); char *fgets(char *, int, FILE *); FILE *fopen(const char *, const char *); -int fprintf(FILE *, const char *, ...); +int fprintf(FILE *, const char *, ...) + __attribute__((__format__ (printf, 2, 3))) + __attribute__((__nonnull__ (2))); int fputc(int, FILE *); int fputs(const char *, FILE *); size_t fread(void *, size_t, size_t, FILE *); FILE *freopen(const char *, const char *, FILE *); -int fscanf(FILE *, const char *, ...); +int fscanf(FILE *, const char *, ...) + __attribute__ ((__format__ (scanf, 2, 3))) + __attribute__ ((__nonnull__ (2))); int fseek(FILE *, long, int); int fseeko(FILE *, off_t, int); int fsetpos(FILE *, const fpos_t *); @@ -253,24 +257,38 @@ extern int sys_nerr; /* perror(3) external variables */ extern char *sys_errlist[]; #endif void perror(const char *); -int printf(const char *, ...); +int printf(const char *, ...) + __attribute__((__format__ (printf, 1, 2))) + __attribute__((__nonnull__ (1))); int putc(int, FILE *); int putchar(int); int puts(const char *); int remove(const char *); int rename(const char *, const char *); void rewind(FILE *); -int scanf(const char *, ...); +int scanf(const char *, ...) + __attribute__ ((__format__ (scanf, 1, 2))) + __attribute__ ((__nonnull__ (1))); void setbuf(FILE *, char *); int setvbuf(FILE *, char *, int, size_t); -int sprintf(char *, const char *, ...); -int sscanf(const char *, const char *, ...); +int sprintf(char *, const char *, ...) + __attribute__((__format__ (printf, 2, 3))) + __attribute__((__nonnull__ (2))); +int sscanf(const char *, const char *, ...) + __attribute__ ((__format__ (scanf, 2, 3))) + __attribute__ ((__nonnull__ (2))); FILE *tmpfile(void); char *tmpnam(char *); int ungetc(int, FILE *); -int vfprintf(FILE *, const char *, __va_list); -int vprintf(const char *, __va_list); -int vsprintf(char *, const char *, __va_list); +int vfprintf(FILE *, const char *, __va_list) + __attribute__((__format__ (printf, 2, 0))) + __attribute__((__nonnull__ (2))); +int vprintf(const char *, __va_list) + __attribute__((__format__ (printf, 1, 0))) + __attribute__((__nonnull__ (1))); +int vsprintf(char *, const char *, __va_list) + __attribute__((__format__ (printf, 2, 0))) + __attribute__((__nonnull__ (2))); #if __ISO_C_VISIBLE >= 1999 || __BSD_VISIBLE int snprintf(char *, size_t, const char *, ...) @@ -453,8 +471,12 @@ extern int __isthreaded; * #define fdprintf dprintf for compatibility */ __BEGIN_DECLS -int fdprintf(int, const char*, ...); -int vfdprintf(int, const char*, __va_list); +int fdprintf(int, const char*, ...) + __attribute__((__format__ (printf, 2, 3))) + __attribute__((__nonnull__ (2))); +int vfdprintf(int, const char*, __va_list) + __attribute__((__format__ (printf, 2, 0))) + __attribute__((__nonnull__ (2))); __END_DECLS #endif /* _GNU_SOURCE */ @@ -463,11 +485,22 @@ __END_DECLS __BIONIC_FORTIFY_INLINE __attribute__((__format__ (printf, 3, 0))) __attribute__((__nonnull__ (3))) -int vsnprintf(char *str, size_t size, const char *format, __va_list ap) +int vsnprintf(char *dest, size_t size, const char *format, __va_list ap) { - return __builtin___vsnprintf_chk(str, size, 0, __builtin_object_size(str, 0), format, ap); + return __builtin___vsnprintf_chk(dest, size, 0, + __builtin_object_size(dest, 0), format, ap); } +__BIONIC_FORTIFY_INLINE +__attribute__((__format__ (printf, 2, 0))) +__attribute__((__nonnull__ (2))) +int vsprintf(char *dest, const char *format, __va_list ap) +{ + return __builtin___vsprintf_chk(dest, 0, + __builtin_object_size(dest, 0), format, ap); +} + + # if !defined(__clang__) /* * Clang doesn't have support for __builtin_va_arg_pack() @@ -479,7 +512,17 @@ __attribute__((__format__ (printf, 3, 4))) __attribute__((__nonnull__ (3))) int snprintf(char *str, size_t size, const char *format, ...) { - return __builtin___snprintf_chk(str, size, 0, __builtin_object_size(str, 0), format, __builtin_va_arg_pack()); + return __builtin___snprintf_chk(str, size, 0, + __builtin_object_size(str, 0), format, __builtin_va_arg_pack()); +} + +__BIONIC_FORTIFY_INLINE +__attribute__((__format__ (printf, 2, 3))) +__attribute__((__nonnull__ (2))) +int sprintf(char *dest, const char *format, ...) +{ + return __builtin___sprintf_chk(dest, 0, + __builtin_object_size(dest, 0), format, __builtin_va_arg_pack()); } # endif /* !defined(__clang__) */ diff --git a/libc/stdio/__sprintf_chk.c b/libc/stdio/__sprintf_chk.c new file mode 100644 index 000000000..67acbe18f --- /dev/null +++ b/libc/stdio/__sprintf_chk.c @@ -0,0 +1,58 @@ +/* + * Copyright (C) 2012 The Android Open Source Project + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT + * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include +#include + +/* + * Runtime implementation of __builtin____sprintf_chk. + * + * See + * http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html + * http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html + * for details. + * + * This sprintf check is called if _FORTIFY_SOURCE is defined and + * greater than 0. + */ +int __sprintf_chk( + char *dest, + int flags, + size_t dest_len_from_compiler, + const char *format, ...) +{ + va_list va; + int retval; + + va_start(va, format); + retval = __vsprintf_chk(dest, flags, + dest_len_from_compiler, format, va); + va_end(va); + + return retval; +} diff --git a/libc/stdio/__vsprintf_chk.c b/libc/stdio/__vsprintf_chk.c new file mode 100644 index 000000000..8a809fc6d --- /dev/null +++ b/libc/stdio/__vsprintf_chk.c @@ -0,0 +1,61 @@ +/* + * Copyright (C) 2012 The Android Open Source Project + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT + * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include +#include +#include +#include + +/* + * Runtime implementation of __builtin____vsprintf_chk. + * + * See + * http://gcc.gnu.org/onlinedocs/gcc/Object-Size-Checking.html + * http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html + * for details. + * + * This vsprintf check is called if _FORTIFY_SOURCE is defined and + * greater than 0. + */ +int __vsprintf_chk( + char *dest, + int flags, + size_t dest_len_from_compiler, + const char *format, + va_list va) +{ + int ret = vsnprintf(dest, dest_len_from_compiler, format, va); + + if ((size_t) ret >= dest_len_from_compiler) { + __libc_android_log_print(ANDROID_LOG_FATAL, "libc", + "*** vsprintf buffer overflow detected ***\n"); + abort(); + } + + return ret; +}