+
+ if (arg == 0LL) {
+ break;
+ }
+
+ argv += ptr_size;
+
+ /*
+ * av[n...] = arg[n]
+ */
+ error = exec_add_user_string(imgp, arg, imgp->ip_seg, TRUE);
+ if (error)
+ goto bad;
+ if (imgp->ip_argspace < new_ptr_size) {
+ error = E2BIG;
+ goto bad;
+ }
+ imgp->ip_argspace -= new_ptr_size; /* to hold argv[] entry */
+ imgp->ip_argc++;
+ }
+
+ /* Save space for argv[] NULL terminator */
+ if (imgp->ip_argspace < new_ptr_size) {
+ error = E2BIG;
+ goto bad;
+ }
+ imgp->ip_argspace -= new_ptr_size;
+
+ /* Note where the args ends and env begins. */
+ imgp->ip_endargv = imgp->ip_strendp;
+ imgp->ip_envc = 0;
+
+ /* Now, get the environment */
+ while (envv != 0LL) {
+ user_addr_t env;
+
+ error = copyinptr(envv, &env, ptr_size);
+ if (error)
+ goto bad;
+
+ envv += ptr_size;
+ if (env == 0LL) {
+ break;
+ }
+ /*
+ * av[n...] = env[n]
+ */
+ error = exec_add_user_string(imgp, env, imgp->ip_seg, TRUE);
+ if (error)
+ goto bad;
+ if (imgp->ip_argspace < new_ptr_size) {
+ error = E2BIG;
+ goto bad;
+ }
+ imgp->ip_argspace -= new_ptr_size; /* to hold envv[] entry */
+ imgp->ip_envc++;
+ }
+
+ /* Save space for envv[] NULL terminator */
+ if (imgp->ip_argspace < new_ptr_size) {
+ error = E2BIG;
+ goto bad;
+ }
+ imgp->ip_argspace -= new_ptr_size;
+
+ /* Align the tail of the combined argv+envv area */
+ while (imgp->ip_strspace % new_ptr_size != 0) {
+ if (imgp->ip_argspace < 1) {
+ error = E2BIG;
+ goto bad;
+ }
+ *imgp->ip_strendp++ = '\0';
+ imgp->ip_strspace--;
+ imgp->ip_argspace--;
+ }
+
+ /* Note where the envv ends and applev begins. */
+ imgp->ip_endenvv = imgp->ip_strendp;
+
+ /*
+ * From now on, we are no longer charging argument
+ * space to ip_argspace.
+ */
+
+bad:
+ return error;
+}
+
+static char *
+random_hex_str(char *str, int len, boolean_t embedNUL)
+{
+ uint64_t low, high, value;
+ int idx;
+ char digit;
+
+ /* A 64-bit value will only take 16 characters, plus '0x' and NULL. */
+ if (len > 19)
+ len = 19;
+
+ /* We need enough room for at least 1 digit */
+ if (len < 4)
+ return (NULL);
+
+ low = random();
+ high = random();
+ value = high << 32 | low;
+
+ if (embedNUL) {
+ /*
+ * Zero a byte to protect against C string vulnerabilities
+ * e.g. for userland __stack_chk_guard.
+ */
+ value &= ~(0xffull << 8);
+ }
+
+ str[0] = '0';
+ str[1] = 'x';
+ for (idx = 2; idx < len - 1; idx++) {
+ digit = value & 0xf;
+ value = value >> 4;
+ if (digit < 10)
+ str[idx] = '0' + digit;
+ else
+ str[idx] = 'a' + (digit - 10);
+ }
+ str[idx] = '\0';
+ return (str);
+}
+
+/*
+ * Libc has an 8-element array set up for stack guard values. It only fills
+ * in one of those entries, and both gcc and llvm seem to use only a single
+ * 8-byte guard. Until somebody needs more than an 8-byte guard value, don't
+ * do the work to construct them.
+ */
+#define GUARD_VALUES 1
+#define GUARD_KEY "stack_guard="
+
+/*
+ * System malloc needs some entropy when it is initialized.
+ */
+#define ENTROPY_VALUES 2
+#define ENTROPY_KEY "malloc_entropy="
+
+/*
+ * System malloc engages nanozone for UIAPP.
+ */
+#define NANO_ENGAGE_KEY "MallocNanoZone=1"
+
+#define PFZ_KEY "pfz="
+extern user32_addr_t commpage_text32_location;
+extern user64_addr_t commpage_text64_location;
+/*
+ * Build up the contents of the apple[] string vector
+ */
+static int
+exec_add_apple_strings(struct image_params *imgp)
+{
+ int i, error;
+ int new_ptr_size=4;
+ char guard[19];
+ char guard_vec[strlen(GUARD_KEY) + 19 * GUARD_VALUES + 1];
+
+ char entropy[19];
+ char entropy_vec[strlen(ENTROPY_KEY) + 19 * ENTROPY_VALUES + 1];
+
+ char pfz_string[strlen(PFZ_KEY) + 16 + 4 +1];
+
+ if( imgp->ip_flags & IMGPF_IS_64BIT) {
+ new_ptr_size = 8;
+ snprintf(pfz_string, sizeof(pfz_string),PFZ_KEY "0x%llx",commpage_text64_location);
+ } else {
+ snprintf(pfz_string, sizeof(pfz_string),PFZ_KEY "0x%x",commpage_text32_location);
+ }
+
+ /* exec_save_path stored the first string */
+ imgp->ip_applec = 1;
+
+ /* adding the pfz string */
+ error = exec_add_user_string(imgp, CAST_USER_ADDR_T(pfz_string),UIO_SYSSPACE,FALSE);
+ if(error)
+ goto bad;
+ imgp->ip_applec++;
+
+ /* adding the NANO_ENGAGE_KEY key */
+ if (imgp->ip_px_sa) {
+ int proc_flags = (((struct _posix_spawnattr *) imgp->ip_px_sa)->psa_flags);
+
+ if ((proc_flags & _POSIX_SPAWN_NANO_ALLOCATOR) == _POSIX_SPAWN_NANO_ALLOCATOR) {
+ char uiapp_string[strlen(NANO_ENGAGE_KEY) + 1];
+
+ snprintf(uiapp_string, sizeof(uiapp_string), NANO_ENGAGE_KEY);
+ error = exec_add_user_string(imgp, CAST_USER_ADDR_T(uiapp_string),UIO_SYSSPACE,FALSE);
projects / apple / xnu.git / blobdiff