1/* $OpenBSD: stack_protector.c,v 1.10 2006/03/31 05:34:44 deraadt Exp $ */ 2 3/* 4 * Copyright (c) 2002 Hiroaki Etoh, Federico G. Schwindt, and Miodrag Vallat. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED 18 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 19 * DISCLAIMED. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, 20 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 21 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 22 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 24 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 25 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 * 28 */ 29 30#include <sys/param.h> 31#include <signal.h> 32#include <string.h> 33#include <stdlib.h> 34#include <asl.h> 35#include <unistd.h> 36#include <sys/types.h> 37#include <fcntl.h> 38#include "CrashReporterClient.h" 39#include "libproc.h" 40#include "_simple.h" 41 42#define GUARD_MAX 8 43long __stack_chk_guard[GUARD_MAX] = {0, 0, 0, 0, 0, 0, 0, 0}; 44void __abort(void) __dead2; 45void __guard_setup(const char *apple[]) __attribute__ ((visibility ("hidden"))); 46void __stack_chk_fail(void); 47 48static void 49__guard_from_kernel(const char *str) 50{ 51 unsigned long long val; 52 char tmp[20], *p; 53 int idx = 0; 54 55 /* Skip over the 'stack_guard=' key to the list of values */ 56 str = strchr(str, '='); 57 if (str == NULL) 58 return; 59 str++; 60 61 while (str && idx < GUARD_MAX) { 62 /* 63 * Pull the next numeric string out of the list and convert it to 64 * a real number. 65 */ 66 strlcpy(tmp, str, 20); 67 p = strchr(tmp, ','); 68 if (p) 69 *p = '\0'; 70 val = strtoull(tmp, NULL, 0); 71 __stack_chk_guard[idx] = (long)(val & ((unsigned long) -1)); 72 idx++; 73 if ((str = strchr(str, ',')) != NULL) 74 str++; 75 } 76} 77 78void 79__guard_setup(const char *apple[]) 80{ 81 int fd; 82 size_t len; 83 const char **p; 84 85 if (__stack_chk_guard[0] != 0) 86 return; 87 88 for (p = apple; p && *p; p++) { 89 if (strstr(*p, "stack_guard") == *p) { 90 __guard_from_kernel(*p); 91 bzero((void*)*p, strlen(*p)); 92 if (__stack_chk_guard[0] != 0) { 93 return; 94 } 95 } 96 } 97 98 fd = open ("/dev/urandom", 0); 99 if (fd != -1) { 100 len = read (fd, (char*)&__stack_chk_guard, sizeof(__stack_chk_guard)); 101 close(fd); 102 if (len == sizeof(__stack_chk_guard) && 103 *__stack_chk_guard != 0) 104 return; 105 } 106 107 /* If If a random generator can't be used, the protector switches the guard 108 to the "terminator canary" */ 109 ((unsigned char *)__stack_chk_guard)[0] = 0; 110 ((unsigned char *)__stack_chk_guard)[1] = 0; 111 ((unsigned char *)__stack_chk_guard)[2] = '\n'; 112 ((unsigned char *)__stack_chk_guard)[3] = 255; 113} 114 115#define STACKOVERFLOW "] stack overflow" 116 117void 118__stack_chk_fail() 119{ 120 char n[16]; // bigger than will hold the digits in a pid_t 121 char *np; 122 int pid = getpid(); 123 char message[sizeof(n) + sizeof(STACKOVERFLOW)] = "["; 124 char prog[2*MAXCOMLEN+1] = {0}; 125 126 proc_name(pid, prog, 2*MAXCOMLEN); 127 prog[2*MAXCOMLEN] = 0; 128 np = n + sizeof(n); 129 *--np = 0; 130 while(pid > 0) { 131 *--np = (pid % 10) + '0'; 132 pid /= 10; 133 } 134 strlcat(message, np, sizeof(message)); 135 strlcat(message, STACKOVERFLOW, sizeof(message)); 136 /* This may fail on a chroot jail... */ 137 _simple_asl_log_prog(ASL_LEVEL_CRIT, "user", message, prog); 138 139 CRSetCrashLogMessage(message); 140 __abort(); 141} 142