sys/OpenBSD/stack_protector.c

   1 /*      $OpenBSD: stack_protector.c,v 1.10 2006/03/31 05:34:44 deraadt Exp $    */
   2
   3 /*
   4  * Copyright (c) 2002 Hiroaki Etoh, Federico G. Schwindt, and Miodrag Vallat.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
  17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  18  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  19  * DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT,
  20  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  21  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
  22  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
  24  * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  25  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  26  * POSSIBILITY OF SUCH DAMAGE.
  27  *
  28  */
  29
  30 #include <sys/param.h>
  31 #include <signal.h>
  32 #include <string.h>
  33 #include <stdlib.h>
  34 #include <asl.h>
  35 #include <unistd.h>
  36 #include <sys/types.h>
  37 #include <fcntl.h>
  38 #include "CrashReporterClient.h"
  39 #include "libproc.h"
  40 #include "_simple.h"
  41
  42 #define GUARD_MAX 8
  43 long __stack_chk_guard[GUARD_MAX] = {0, 0, 0, 0, 0, 0, 0, 0};
  44 void __abort(void) __dead2;
  45 void __guard_setup(const char *apple[]) __attribute__ ((visibility ("hidden")));
  46 void __stack_chk_fail(void);
  47
  48 static void
  49 __guard_from_kernel(const char *str)
  50 {
  51         unsigned long long val;
  52         char tmp[20], *p;
  53         int idx = 0;
  54
  55         /* Skip over the 'stack_guard=' key to the list of values */
  56         str = strchr(str, '=');
  57         if (str == NULL)
  58                 return;
  59         str++;
  60
  61         while (str && idx < GUARD_MAX) {
  62                 /*
  63                  * Pull the next numeric string out of the list and convert it to
  64                  * a real number.
  65                  */
  66                 strlcpy(tmp, str, 20);
  67                 p = strchr(tmp, ',');
  68                 if (p)
  69                         *p = '\0';
  70                 val = strtoull(tmp, NULL, 0);
  71                 __stack_chk_guard[idx] = (long)(val & ((unsigned long) -1));
  72                 idx++;
  73                 if ((str = strchr(str, ',')) != NULL)
  74                         str++;
  75         }
  76 }
  77
  78 void
  79 __guard_setup(const char *apple[])
  80 {
  81         int fd;
  82         size_t len;
  83         const char **p;
  84
  85         if (__stack_chk_guard[0] != 0)
  86                 return;
  87
  88         for (p = apple; p && *p; p++) {
  89                 if (strstr(*p, "stack_guard") == *p) {
  90                         __guard_from_kernel(*p);
  91                         bzero((void*)*p, strlen(*p));
  92                         if (__stack_chk_guard[0] != 0) {
  93                                 return;
  94                         }
  95                 }
  96         }
  97
  98         fd = open ("/dev/urandom", 0);
  99         if (fd != -1) {
 100                 len = read (fd, (char*)&__stack_chk_guard, sizeof(__stack_chk_guard));
 101                 close(fd);
 102                 if (len == sizeof(__stack_chk_guard) &&
 103                     *__stack_chk_guard != 0)
 104                         return;
 105         }
 106
 107         /* If If a random generator can't be used, the protector switches the guard
 108            to the "terminator canary" */
 109         ((unsigned char *)__stack_chk_guard)[0] = 0;
 110         ((unsigned char *)__stack_chk_guard)[1] = 0;
 111         ((unsigned char *)__stack_chk_guard)[2] = '\n';
 112         ((unsigned char *)__stack_chk_guard)[3] = 255;
 113 }
 114
 115 #define STACKOVERFLOW   "] stack overflow"
 116
 117 void
 118 __stack_chk_fail()
 119 {
 120         char n[16]; // bigger than will hold the digits in a pid_t
 121         char *np;
 122         int pid = getpid();
 123         char message[sizeof(n) + sizeof(STACKOVERFLOW)] = "[";
 124         char prog[2*MAXCOMLEN+1] = {0};
 125
 126         proc_name(pid, prog, 2*MAXCOMLEN);
 127         prog[2*MAXCOMLEN] = 0;
 128         np = n + sizeof(n);
 129         *--np = 0;
 130         while(pid > 0) {
 131             *--np = (pid % 10) + '0';
 132             pid /= 10;
 133         }
 134         strlcat(message, np, sizeof(message));
 135         strlcat(message, STACKOVERFLOW, sizeof(message));
 136         /* This may fail on a chroot jail... */
 137         _simple_asl_log_prog(ASL_LEVEL_CRIT, "user", message, prog);
 138
 139         CRSetCrashLogMessage(message);
 140         __abort();
 141 }