LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-01-07 19:57:45 +03:00
Code Issues Packages Projects Releases Wiki Activity
b4cabde4a4
ladybird/Userland/Libraries/LibELF/Validation.cpp

349 lines
14 KiB
C++
Raw Normal View History

LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
/*
AK+Userland: Use akaster@serenityos.org for my copyright headers
2021-05-30 16:28:59 +03:00
* Copyright (c) 2020, Andrew Kaster <akaster@serenityos.org>
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
* Copyright (c) 2021, Andreas Kling <kling@serenityos.org>
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
*
Everything: Move to SPDX license identifiers in all files. SPDX License Identifiers are a more compact / standardized way of representing file license information. See: https://spdx.dev/resources/use/#identifiers This was done with the `ambr` search and replace tool. ambr --no-parent-ignore --key-from-file --rep-from-file key.txt rep.txt *
2021-04-22 11:24:48 +03:00
* SPDX-License-Identifier: BSD-2-Clause
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
*/
#include <AK/Assertions.h>
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
#include <AK/Checked.h>
Kernel+LibC+LibELF: Set stack size based on PT_GNU_STACK during execve Some programs explicitly ask for a different initial stack size than what the OS provides. This is implemented in ELF by having a PT_GNU_STACK header which has its p_memsz set to the amount that the program requires. This commit implements this policy by reading the p_memsz of the header and setting the main thread stack size to that. ELF::Image::validate_program_headers ensures that the size attribute is a reasonable value.
2022-10-01 22:29:59 +03:00
#include <Kernel/API/serenity_limits.h>
LibC+LibELF: Move ELF definitions from LibC to LibELF This is needed to avoid including LibC headers in Lagom builds. Unfortunately, we cannot rely on the build machine to provide a fully POSIX-compatible ELF header for Lagom builds, so we have to use our own.
2023-04-30 18:07:21 +03:00
#include <LibELF/ELFABI.h>
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
#include <LibELF/Validation.h>
Everywhere: Remove string.h include from AK/Traits.h and resolve fallout A lot of places were relying on AK/Traits.h to give it strnlen, memcmp, memcpy and other related declarations. In the quest to remove inclusion of LibC headers from Kernel files, deal with all the fallout of this included-everywhere header including less things.
2023-01-07 23:57:33 +03:00
#ifndef KERNEL
# include <limits.h>
# include <pthread.h>
#endif
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
namespace ELF {
LibELF: Accept Span instead of Pointer+Size in validate_program_headers
2022-01-13 21:54:53 +03:00
bool validate_elf_header(ElfW(Ehdr) const& elf_header, size_t file_size, bool verbose)
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
{
if (!IS_ELF(elf_header)) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("File is not an ELF file.");
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
auto expected_class = ELFCLASS64;
auto expected_bitness = 64;
if (expected_class != elf_header.e_ident[EI_CLASS]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
dbgln("File is not a {}-bit ELF file.", expected_bitness);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
if (ELFDATA2LSB != elf_header.e_ident[EI_DATA]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("File is not a little endian ELF file.");
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
if (EV_CURRENT != elf_header.e_ident[EI_VERSION]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("File has unrecognized ELF version ({}), expected ({})!", elf_header.e_ident[EI_VERSION], EV_CURRENT);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibELF: Relax restriction on allowed values of EI_OSABI to allow GNU This check is here to make sure we only try to load serenity binaries. However, with -fprofile-instr-generate -fcoverage-mapping, clang sets the EI_OSABI field to 3, for GNU. The instrumentation uses a lot of retained COMDAT sections for coverage instrumentation that get the SHF_GNU_RETAINED section header flag set on them, forcing llvm to set the ABI to GNU.
2022-03-05 04:02:23 +03:00
// NOTE: With Clang, -fprofile-instr-generate -fcoverage-mapping sets our ELF ABI Version to 3 b/c of SHF_GNU_RETAIN
if (ELFOSABI_SYSV != elf_header.e_ident[EI_OSABI] && ELFOSABI_LINUX != elf_header.e_ident[EI_OSABI]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Relax restriction on allowed values of EI_OSABI to allow GNU This check is here to make sure we only try to load serenity binaries. However, with -fprofile-instr-generate -fcoverage-mapping, clang sets the EI_OSABI field to 3, for GNU. The instrumentation uses a lot of retained COMDAT sections for coverage instrumentation that get the SHF_GNU_RETAINED section header flag set on them, forcing llvm to set the ABI to GNU.
2022-03-05 04:02:23 +03:00
dbgln("File has unknown OS ABI ({}), expected SYSV(0) or GNU/Linux(3)!", elf_header.e_ident[EI_OSABI]);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
if (0 != elf_header.e_ident[EI_ABIVERSION]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("File has unknown SYSV ABI version ({})!", elf_header.e_ident[EI_ABIVERSION]);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibELF: Add initial RISC-V support This is an almost-minimal patchset to get RISC-V ELF files to pass validation. Unlike other architectures, eflags are actually used here.
2023-10-13 21:10:33 +03:00
auto expected_machines = Array { EM_X86_64, EM_AARCH64, EM_RISCV };
auto expected_machine_names = Array { "x86-64"sv, "aarch64"sv, "riscv64"sv };
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
LibELF: Add EM_AARCH64 as expected architecture for ELF validation
2023-01-29 15:11:30 +03:00
if (!expected_machines.span().contains_slow(elf_header.e_machine)) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Add EM_AARCH64 as expected architecture for ELF validation
2023-01-29 15:11:30 +03:00
dbgln("File has unknown machine ({}), expected {} ({})!", elf_header.e_machine, expected_machine_names.span(), expected_machines.span());
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-12-01 09:18:49 +03:00
if (ET_EXEC != elf_header.e_type && ET_DYN != elf_header.e_type && ET_REL != elf_header.e_type && ET_CORE != elf_header.e_type) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("File has unloadable ELF type ({}), expected REL (1), EXEC (2), DYN (3) or CORE(4)!", elf_header.e_type);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
if (EV_CURRENT != elf_header.e_version) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("File has unrecognized ELF version ({}), expected ({})!", elf_header.e_version, EV_CURRENT);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
if (sizeof(ElfW(Ehdr)) != elf_header.e_ehsize) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
dbgln("File has incorrect ELF header size..? ({}), expected ({})!", elf_header.e_ehsize, sizeof(ElfW(Ehdr)));
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibElf+readelf: Parse ELFs with no program headers correctly This simply fixes a check which assumed the program header count was always non zero.
2021-03-29 15:14:41 +03:00
if ((elf_header.e_phnum != 0 && elf_header.e_phoff < elf_header.e_ehsize) || (elf_header.e_shnum != SHN_UNDEF && elf_header.e_shoff < elf_header.e_ehsize)) {
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-12-01 09:18:49 +03:00
if (verbose) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("SHENANIGANS! program header offset ({}) or section header offset ({}) overlap with ELF header!",
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-12-01 09:18:49 +03:00
elf_header.e_phoff, elf_header.e_shoff);
}
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
if (elf_header.e_phoff > file_size || elf_header.e_shoff > file_size) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("SHENANIGANS! program header offset ({}) or section header offset ({}) are past the end of the file!",
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
elf_header.e_phoff, elf_header.e_shoff);
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-12-01 09:18:49 +03:00
if (elf_header.e_phnum == 0 && elf_header.e_phoff != 0) {
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("SHENANIGANS! File has no program headers, but it does have a program header offset ({})!", elf_header.e_phoff);
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-12-01 09:18:49 +03:00
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
if (elf_header.e_phnum != 0 && elf_header.e_phoff != elf_header.e_ehsize) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("File does not have program headers directly after the ELF header? program header offset ({}), expected ({}).",
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
elf_header.e_phoff, elf_header.e_ehsize);
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
if (0 != elf_header.e_flags) {
LibELF: Add initial RISC-V support This is an almost-minimal patchset to get RISC-V ELF files to pass validation. Unlike other architectures, eflags are actually used here.
2023-10-13 21:10:33 +03:00
// TODO: Refuse to run C ABI binaries on system without the C extension.
// TODO: Refuse to run TSO ABI binaries on system without the Ztso extension.
if (elf_header.e_machine == EM_RISCV) {
auto float_abi = elf_header.e_flags & EF_RISCV_FLOAT_ABI;
// TODO: Support 32-bit hardware float ABI somehow?
if (float_abi != EF_RISCV_FLOAT_ABI_DOUBLE) {
if (verbose)
dbgln("File has unsupported float ABI ({}), only double ({}) is supported.", float_abi, EF_RISCV_FLOAT_ABI_DOUBLE);
return false;
}
} else {
if (verbose)
dbgln("File has incorrect ELF header flags...? ({}), expected ({}).", elf_header.e_flags, 0);
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
}
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
if (0 != elf_header.e_phnum && sizeof(ElfW(Phdr)) != elf_header.e_phentsize) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
dbgln("File has incorrect program header size..? ({}), expected ({}).", elf_header.e_phentsize, sizeof(ElfW(Phdr)));
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
if (sizeof(ElfW(Shdr)) != elf_header.e_shentsize) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
dbgln("File has incorrect section header size..? ({}), expected ({}).", elf_header.e_shentsize, sizeof(ElfW(Shdr)));
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
Checked<size_t> total_size_of_program_headers = elf_header.e_phnum;
total_size_of_program_headers *= elf_header.e_phentsize;
Checked<size_t> end_of_last_program_header = elf_header.e_phoff;
end_of_last_program_header += total_size_of_program_headers;
if (end_of_last_program_header.has_overflow()) {
if (verbose)
dbgln("SHENANIGANS! Integer overflow in program header validation");
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
if (end_of_last_program_header > file_size) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
dbgln("SHENANIGANS! End of last program header ({}) is past the end of the file!", end_of_last_program_header.value());
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
if (elf_header.e_shoff != SHN_UNDEF && elf_header.e_shoff < end_of_last_program_header.value()) {
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-12-01 09:18:49 +03:00
if (verbose) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("SHENANIGANS! Section header table begins at file offset {}, which is within program headers [ {} - {} ]!",
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
elf_header.e_shoff, elf_header.e_phoff, end_of_last_program_header.value());
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-12-01 09:18:49 +03:00
}
return false;
}
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
Checked<size_t> total_size_of_section_headers = elf_header.e_shnum;
total_size_of_section_headers *= elf_header.e_shentsize;
Checked<size_t> end_of_last_section_header = elf_header.e_shoff;
end_of_last_section_header += total_size_of_section_headers;
if (end_of_last_section_header.has_overflow()) {
if (verbose)
dbgln("SHENANIGANS! Integer overflow in section header validation");
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
if (end_of_last_section_header > file_size) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
dbgln("SHENANIGANS! End of last section header ({}) is past the end of the file!", end_of_last_section_header.value());
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibELF: Allow using ELF::Loader for ET_CORE objects
2020-11-11 23:04:33 +03:00
if (elf_header.e_shstrndx != SHN_UNDEF && elf_header.e_shstrndx >= elf_header.e_shnum) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 16:55:17 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("SHENANIGANS! Section header string table index ({}) is not a valid index given we have {} section headers!", elf_header.e_shstrndx, elf_header.e_shnum);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
return true;
}
Kernel: Consolidate finding the ELF stack size with validation Previously, we started parsing the ELF file again in a completely different place, and without the partial mapping that we do while validating. Instead of doing manual parsing in two places, just capture the requested stack size right after we validated it.
2023-07-10 12:13:13 +03:00
ErrorOr<bool> validate_program_headers(ElfW(Ehdr) const& elf_header, size_t file_size, ReadonlyBytes buffer, StringBuilder* interpreter_path_builder, Optional<size_t>* requested_stack_size, bool verbose)
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
{
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
Checked<size_t> total_size_of_program_headers = elf_header.e_phnum;
total_size_of_program_headers *= elf_header.e_phentsize;
Checked<size_t> end_of_last_program_header = elf_header.e_phoff;
end_of_last_program_header += total_size_of_program_headers;
if (end_of_last_program_header.has_overflow()) {
if (verbose)
dbgln("SHENANIGANS! Integer overflow in program header validation");
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
// Can we actually parse all the program headers in the given buffer?
LibELF: Accept Span instead of Pointer+Size in validate_program_headers
2022-01-13 21:54:53 +03:00
if (end_of_last_program_header > buffer.size()) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-12-01 09:21:55 +03:00
if (verbose)
LibELF: Accept Span instead of Pointer+Size in validate_program_headers
2022-01-13 21:54:53 +03:00
dbgln("Unable to parse program headers from buffer, buffer too small! Buffer size: {}, End of program headers {}", buffer.size(), end_of_last_program_header.value());
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibELF: Accept Span instead of Pointer+Size in validate_program_headers
2022-01-13 21:54:53 +03:00
if (file_size < buffer.size()) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("We somehow read more from a file than was in the file in the first place!");
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 22:42:32 +03:00
VERIFY_NOT_REACHED();
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
}
size_t num_program_headers = elf_header.e_phnum;
LibELF: Accept Span instead of Pointer+Size in validate_program_headers
2022-01-13 21:54:53 +03:00
auto program_header_begin = (const ElfW(Phdr)*)buffer.offset(elf_header.e_phoff);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
for (size_t header_index = 0; header_index < num_program_headers; ++header_index) {
auto& program_header = program_header_begin[header_index];
LibELF: Reject ELF with program header p_filesz larger than p_memsz
2020-12-28 01:01:56 +03:00
if (program_header.p_filesz > program_header.p_memsz) {
if (verbose)
dbgln("Program header ({}) has p_filesz ({}) larger than p_memsz ({})", header_index, program_header.p_filesz, program_header.p_memsz);
LibELF: validate_program_headers: Validate p_memsz and p_align
2021-01-01 05:36:55 +03:00
return false;
}
LibELF: Don't validate PT_LOAD alignment in ET_CORE files This was causing CrashDaemon to choke on our coredumps. Note that we didn't care about the validation failures before this change either, this patch simply reorders the checks to avoid divide-by-zero when validating an ET_CORE file.
2021-06-29 11:43:58 +03:00
if (elf_header.e_type != ET_CORE) {
LibELF: Check for missing PT_LOAD alignment header value This ensures we dont divide by zero when checking for valid alignment values.
2021-06-30 19:59:03 +03:00
if (program_header.p_type == PT_LOAD && program_header.p_align == 0) {
if (verbose)
dbgln("Program header ({}) with p_type PT_LOAD missing p_align (p_align == 0)", header_index);
return false;
}
LibELF: Don't validate PT_LOAD alignment in ET_CORE files This was causing CrashDaemon to choke on our coredumps. Note that we didn't care about the validation failures before this change either, this patch simply reorders the checks to avoid divide-by-zero when validating an ET_CORE file.
2021-06-29 11:43:58 +03:00
if (program_header.p_type == PT_LOAD && program_header.p_align % (size_t)PAGE_SIZE != 0) {
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
if (verbose)
dbgln("Program header ({}) with p_type PT_LOAD has p_align ({}) not divisible by page size ({})", header_index, program_header.p_align, PAGE_SIZE);
return false;
}
LibELF: Don't validate PT_LOAD alignment in ET_CORE files This was causing CrashDaemon to choke on our coredumps. Note that we didn't care about the validation failures before this change either, this patch simply reorders the checks to avoid divide-by-zero when validating an ET_CORE file.
2021-06-29 11:43:58 +03:00
if (program_header.p_type == PT_LOAD && program_header.p_vaddr % program_header.p_align != program_header.p_offset % program_header.p_align) {
LibELF: validate_program_headers: Validate p_memsz and p_align
2021-01-01 05:36:55 +03:00
if (verbose)
Kernel+LibELF: Add support for validating and loading ELF64 executables
2021-06-28 18:24:08 +03:00
dbgln("Program header ({}) with p_type PT_LOAD has mis-aligned p_vaddr ({:x})", header_index, program_header.p_vaddr);
LibELF: validate_program_headers: Validate p_memsz and p_align
2021-01-01 05:36:55 +03:00
return false;
}
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
switch (program_header.p_type) {
case PT_INTERP:
// We checked above that file_size was >= buffer size. We only care about buffer size anyway, we're trying to read this!
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
if (Checked<size_t>::addition_would_overflow(program_header.p_offset, program_header.p_filesz)) {
if (verbose)
dbgln("Integer overflow while validating PT_INTERP header");
return false;
}
LibELF: Accept Span instead of Pointer+Size in validate_program_headers
2022-01-13 21:54:53 +03:00
if (program_header.p_offset + program_header.p_filesz > buffer.size()) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-12-01 09:21:55 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("Found PT_INTERP header ({}), but the .interp section was not within the buffer :(", header_index);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
LibELF: validate_program_headers: Validate PT_INTERP header p_filesz > 1
2021-01-16 20:35:46 +03:00
if (program_header.p_filesz <= 1) {
if (verbose)
dbgln("Found PT_INTERP header ({}), but p_filesz is invalid ({})", header_index, program_header.p_filesz);
return false;
}
LibELF: Use StringBuilders instead of Strings for the interpreter path This is required for the Kernel's usage of LibELF, since Strings do not expose allocation failure.
2022-01-13 19:50:17 +03:00
if (interpreter_path_builder)
LibELF: Fix building without PTHREAD_STACK_MIN defined It may or may not be defined according to Dr. POSIX. Also, sneak in a little fix for passing a 64-bit value into a size_t-typed argument.
2023-09-03 22:11:39 +03:00
TRY(interpreter_path_builder->try_append({ buffer.offset(program_header.p_offset), static_cast<size_t>(program_header.p_filesz) - 1 }));
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
break;
case PT_LOAD:
case PT_DYNAMIC:
LibElf: Allow PT_GNU_EH_FRAME program headers These are built when compiling an executable with exception support.
2021-04-16 22:48:57 +03:00
case PT_GNU_EH_FRAME:
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
case PT_NOTE:
case PT_PHDR:
case PT_TLS:
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 15:54:24 +03:00
if (Checked<size_t>::addition_would_overflow(program_header.p_offset, program_header.p_filesz)) {
if (verbose)
dbgln("Integer overflow while validating a program header");
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
if (program_header.p_offset + program_header.p_filesz > file_size) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-12-01 09:21:55 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("SHENANIGANS! Program header {} segment leaks beyond end of file!", header_index);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
if ((program_header.p_flags & PF_X) && (program_header.p_flags & PF_W)) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-12-01 09:21:55 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("SHENANIGANS! Program header {} segment is marked write and execute", header_index);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
break;
LibELF: Ignore PT_GNU_STACK headers We always map stacks R/W (never X), so we can just ignore this header as far as I understand.
2020-08-20 11:08:02 +03:00
case PT_GNU_STACK:
if (program_header.p_flags & PF_X) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-12-01 09:21:55 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("Possible shenanigans! Validating an ELF with executable stack.");
LibELF: Ignore PT_GNU_STACK headers We always map stacks R/W (never X), so we can just ignore this header as far as I understand.
2020-08-20 11:08:02 +03:00
}
Kernel+LibC+LibELF: Set stack size based on PT_GNU_STACK during execve Some programs explicitly ask for a different initial stack size than what the OS provides. This is implemented in ELF by having a PT_GNU_STACK header which has its p_memsz set to the amount that the program requires. This commit implements this policy by reading the p_memsz of the header and setting the main thread stack size to that. ELF::Image::validate_program_headers ensures that the size attribute is a reasonable value.
2022-10-01 22:29:59 +03:00
if (program_header.p_memsz != 0) {
LibELF: Fix building without PTHREAD_STACK_MIN defined It may or may not be defined according to Dr. POSIX. Also, sneak in a little fix for passing a 64-bit value into a size_t-typed argument.
2023-09-03 22:11:39 +03:00
if (
#ifdef PTHREAD_STACK_MIN
program_header.p_memsz < static_cast<unsigned>(PTHREAD_STACK_MIN) ||
#endif
program_header.p_memsz > static_cast<unsigned>(PTHREAD_STACK_MAX)) {
Kernel+LibC+LibELF: Set stack size based on PT_GNU_STACK during execve Some programs explicitly ask for a different initial stack size than what the OS provides. This is implemented in ELF by having a PT_GNU_STACK header which has its p_memsz set to the amount that the program requires. This commit implements this policy by reading the p_memsz of the header and setting the main thread stack size to that. ELF::Image::validate_program_headers ensures that the size attribute is a reasonable value.
2022-10-01 22:29:59 +03:00
if (verbose)
dbgln("PT_GNU_STACK defines an unacceptable stack size.");
return false;
}
if (program_header.p_memsz % PAGE_SIZE != 0) {
if (verbose)
dbgln("PT_GNU_STACK size is not page-aligned.");
return false;
}
Kernel: Consolidate finding the ELF stack size with validation Previously, we started parsing the ELF file again in a completely different place, and without the partial mapping that we do while validating. Instead of doing manual parsing in two places, just capture the requested stack size right after we validated it.
2023-07-10 12:13:13 +03:00
if (requested_stack_size)
*requested_stack_size = program_header.p_memsz;
Kernel+LibC+LibELF: Set stack size based on PT_GNU_STACK during execve Some programs explicitly ask for a different initial stack size than what the OS provides. This is implemented in ELF by having a PT_GNU_STACK header which has its p_memsz set to the amount that the program requires. This commit implements this policy by reading the p_memsz of the header and setting the main thread stack size to that. ELF::Image::validate_program_headers ensures that the size attribute is a reasonable value.
2022-10-01 22:29:59 +03:00
}
LibELF: Ignore PT_GNU_STACK headers We always map stacks R/W (never X), so we can just ignore this header as far as I understand.
2020-08-20 11:08:02 +03:00
break;
LibELF: Validate PT_GNU_RELRO program header I'm not sure if this is the correct validation. This is based on it being "read-only after relocation".
2020-09-09 10:40:17 +03:00
case PT_GNU_RELRO:
if ((program_header.p_flags & PF_X) && (program_header.p_flags & PF_W)) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-12-01 09:21:55 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("SHENANIGANS! Program header {} segment is marked write and execute", header_index);
LibELF: Validate PT_GNU_RELRO program header I'm not sure if this is the correct validation. This is based on it being "read-only after relocation".
2020-09-09 10:40:17 +03:00
return false;
}
break;
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
default:
// Not handling other program header types in other code so... let's not surprise them
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-12-01 09:21:55 +03:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 11:33:56 +03:00
dbgln("Found program header ({}) of unrecognized type {}!", header_index, program_header.p_type);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 21:32:38 +03:00
return false;
}
}
return true;
}
} // end namespace ELF
Reference in New Issue Copy Permalink