LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-01-07 19:57:45 +03:00
Code Issues Packages Projects Releases Wiki Activity

LibELF: Add stack guard hardening

Browse Source 
Employ the same hardening that glibc and the Linux kernel use for
generating stack guards: zero the first byte of the guard such that
if C-style string functions read out of bounds on the stack, we do
not overwrite or potentially leak the stack guard.
This commit is contained in:
Keegan Saunders 2022-11-27 15:46:17 -05:00 committed by Andreas Kling
parent 89b23c473a
commit e575339564
Notes: sideshowbarker 2024-07-19 17:01:42 +09:00 
Author: https://github.com/meme
Commit: https://github.com/SerenityOS/serenity/commit/e5753395642
Pull-request: https://github.com/SerenityOS/serenity/pull/16230
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Userland/Libraries/LibC/ssp.cpp
View File

@ -18,6 +18,7 @@
extern "C" {
extern uintptr_t __stack_chk_guard;
// Initialized in `initialize_libc` (we leave a placeholder value here before initialization).
__attribute__((used)) uintptr_t __stack_chk_guard = (uintptr_t)0xc6c7c8c9;
__attribute__((noreturn)) void __stack_chk_fail()

10
Userland/Libraries/LibELF/DynamicLinker.cpp
View File

@ -13,6 +13,7 @@
#include <AK/HashTable.h>
#include <AK/LexicalPath.h>
#include <AK/NonnullRefPtrVector.h>
#include <AK/Platform.h>
#include <AK/ScopeGuard.h>
#include <AK/Vector.h>
#include <LibC/bits/pthread_integration.h>
@ -258,7 +259,14 @@ static void initialize_libc(DynamicObject& libc)
// This is not done in __libc_init, as we definitely have to return from that, and it might affect Loader as well.
res = libc.lookup_symbol("__stack_chk_guard"sv);
VERIFY(res.has_value());
arc4random_buf(res.value().address.as_ptr(), sizeof(uintptr_t));
void* stack_guard = res.value().address.as_ptr();
arc4random_buf(stack_guard, sizeof(uintptr_t));
#ifdef AK_ARCH_64_BIT
// For 64-bit platforms we include an additional hardening: zero the first byte of the stack guard to avoid
// leaking or overwriting the stack guard with C-style string functions.
((char*)stack_guard)[0] = 0;
#endif
res = libc.lookup_symbol("__environ_is_malloced"sv);
VERIFY(res.has_value());