Stowage/ladybird
2
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-11-05 07:40:58 +00:00
Code Issues Projects Releases Packages Wiki Activity
ladybird/Userland/Libraries/LibELF/Validation.cpp

317 lines
13 KiB
C++
Raw Normal View History

LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
/*
* Copyright (c) 2020, Andrew Kaster <andrewdkaster@gmail.com>
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
* Copyright (c) 2021, Andreas Kling <kling@serenityos.org>
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <AK/Assertions.h>
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
#include <AK/Checked.h>
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
#include <AK/String.h>
#include <LibELF/Validation.h>
Meta+LibC through LibHTTP: Make clang-format-10 clean Why break at LibHTTP? Because "Meta+Libraries" would be insanely large, and breaking between LibHTTP and LibJS makes the commits roughly evenly large.
2020-09-18 09:49:51 +02:00
#include <LibELF/exec_elf.h>
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
namespace ELF {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
bool validate_elf_header(const Elf32_Ehdr& elf_header, size_t file_size, bool verbose)
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
{
if (!IS_ELF(elf_header)) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File is not an ELF file.");
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (ELFCLASS32 != elf_header.e_ident[EI_CLASS]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File is not a 32 bit ELF file.");
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (ELFDATA2LSB != elf_header.e_ident[EI_DATA]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File is not a little endian ELF file.");
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (EV_CURRENT != elf_header.e_ident[EI_VERSION]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has unrecognized ELF version ({}), expected ({})!", elf_header.e_ident[EI_VERSION], EV_CURRENT);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (ELFOSABI_SYSV != elf_header.e_ident[EI_OSABI]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has unknown OS ABI ({}), expected SYSV(0)!", elf_header.e_ident[EI_OSABI]);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (0 != elf_header.e_ident[EI_ABIVERSION]) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has unknown SYSV ABI version ({})!", elf_header.e_ident[EI_ABIVERSION]);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (EM_386 != elf_header.e_machine) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has unknown machine ({}), expected i386 (3)!", elf_header.e_machine);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-11-30 23:18:49 -07:00
if (ET_EXEC != elf_header.e_type && ET_DYN != elf_header.e_type && ET_REL != elf_header.e_type && ET_CORE != elf_header.e_type) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has unloadable ELF type ({}), expected REL (1), EXEC (2), DYN (3) or CORE(4)!", elf_header.e_type);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (EV_CURRENT != elf_header.e_version) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has unrecognized ELF version ({}), expected ({})!", elf_header.e_version, EV_CURRENT);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (sizeof(Elf32_Ehdr) != elf_header.e_ehsize) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has incorrect ELF header size..? ({}), expected ({})!", elf_header.e_ehsize, sizeof(Elf32_Ehdr));
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
LibElf+readelf: Parse ELFs with no program headers correctly This simply fixes a check which assumed the program header count was always non zero.
2021-03-29 15:14:41 +03:00
if ((elf_header.e_phnum != 0 && elf_header.e_phoff < elf_header.e_ehsize) || (elf_header.e_shnum != SHN_UNDEF && elf_header.e_shoff < elf_header.e_ehsize)) {
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-11-30 23:18:49 -07:00
if (verbose) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("SHENANIGANS! program header offset ({}) or section header offset ({}) overlap with ELF header!",
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-11-30 23:18:49 -07:00
elf_header.e_phoff, elf_header.e_shoff);
}
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
if (elf_header.e_phoff > file_size || elf_header.e_shoff > file_size) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("SHENANIGANS! program header offset ({}) or section header offset ({}) are past the end of the file!",
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
elf_header.e_phoff, elf_header.e_shoff);
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-11-30 23:18:49 -07:00
if (elf_header.e_phnum == 0 && elf_header.e_phoff != 0) {
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("SHENANIGANS! File has no program headers, but it does have a program header offset ({})!", elf_header.e_phoff);
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-11-30 23:18:49 -07:00
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
if (elf_header.e_phnum != 0 && elf_header.e_phoff != elf_header.e_ehsize) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File does not have program headers directly after the ELF header? program header offset ({}), expected ({}).",
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
elf_header.e_phoff, elf_header.e_ehsize);
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (0 != elf_header.e_flags) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has incorrect ELF header flags...? ({}), expected ({}).", elf_header.e_flags, 0);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (0 != elf_header.e_phnum && sizeof(Elf32_Phdr) != elf_header.e_phentsize) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has incorrect program header size..? ({}), expected ({}).", elf_header.e_phentsize, sizeof(Elf32_Phdr));
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (sizeof(Elf32_Shdr) != elf_header.e_shentsize) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("File has incorrect section header size..? ({}), expected ({}).", elf_header.e_shentsize, sizeof(Elf32_Shdr));
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
Checked<size_t> total_size_of_program_headers = elf_header.e_phnum;
total_size_of_program_headers *= elf_header.e_phentsize;
Checked<size_t> end_of_last_program_header = elf_header.e_phoff;
end_of_last_program_header += total_size_of_program_headers;
if (end_of_last_program_header.has_overflow()) {
if (verbose)
dbgln("SHENANIGANS! Integer overflow in program header validation");
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
if (end_of_last_program_header > file_size) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
dbgln("SHENANIGANS! End of last program header ({}) is past the end of the file!", end_of_last_program_header.value());
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
if (elf_header.e_shoff != SHN_UNDEF && elf_header.e_shoff < end_of_last_program_header.value()) {
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-11-30 23:18:49 -07:00
if (verbose) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("SHENANIGANS! Section header table begins at file offset {}, which is within program headers [ {} - {} ]!",
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
elf_header.e_shoff, elf_header.e_phoff, end_of_last_program_header.value());
LibELF: Catch more Shenanigans in ELF files Check for even more weird program header/section header offsets and sizes. Namely, the ones encountered in #4221 :)
2020-11-30 23:18:49 -07:00
}
return false;
}
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
Checked<size_t> total_size_of_section_headers = elf_header.e_shnum;
total_size_of_section_headers *= elf_header.e_shentsize;
Checked<size_t> end_of_last_section_header = elf_header.e_shoff;
end_of_last_section_header += total_size_of_section_headers;
if (end_of_last_section_header.has_overflow()) {
if (verbose)
dbgln("SHENANIGANS! Integer overflow in section header validation");
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
if (end_of_last_section_header > file_size) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
dbgln("SHENANIGANS! End of last section header ({}) is past the end of the file!", end_of_last_section_header.value());
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
LibELF: Allow using ELF::Loader for ET_CORE objects
2020-11-11 22:04:33 +02:00
if (elf_header.e_shstrndx != SHN_UNDEF && elf_header.e_shstrndx >= elf_header.e_shnum) {
Lagom+LibELF: Add an ELF fuzzer, and tweak the code to survive a few minutes of fuzzing (#3071) If a buffer smaller than Elf32_Ehdr was passed to Image, header() would do an out-of-bounds read. Make parse() check for that. Make most Image methods assert that the image is_valid(). For that to work, set m_valid early in Image::parse() instead of only at its end. Also reorder a few things so that the fuzzer doesn't hit (valid) assertions, which were harmless from a security PoV but which still allowed userspace to crash the kernel with an invalid ELF file. Make dbgprintf()s configurable at run time so that the fuzzer doesn't produce lots of logspam.
2020-08-10 09:55:17 -04:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("SHENANIGANS! Section header string table index ({}) is not a valid index given we have {} section headers!", elf_header.e_shstrndx, elf_header.e_shnum);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
return true;
}
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-11-30 23:21:55 -07:00
bool validate_program_headers(const Elf32_Ehdr& elf_header, size_t file_size, const u8* buffer, size_t buffer_size, String* interpreter_path, bool verbose)
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
{
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
Checked<size_t> total_size_of_program_headers = elf_header.e_phnum;
total_size_of_program_headers *= elf_header.e_phentsize;
Checked<size_t> end_of_last_program_header = elf_header.e_phoff;
end_of_last_program_header += total_size_of_program_headers;
if (end_of_last_program_header.has_overflow()) {
if (verbose)
dbgln("SHENANIGANS! Integer overflow in program header validation");
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
// Can we actually parse all the program headers in the given buffer?
if (end_of_last_program_header > buffer_size) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-11-30 23:21:55 -07:00
if (verbose)
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
dbgln("Unable to parse program headers from buffer, buffer too small! Buffer size: {}, End of program headers {}", buffer_size, end_of_last_program_header.value());
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if (file_size < buffer_size) {
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("We somehow read more from a file than was in the file in the first place!");
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 20:42:32 +01:00
VERIFY_NOT_REACHED();
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
}
size_t num_program_headers = elf_header.e_phnum;
auto program_header_begin = (const Elf32_Phdr*)&(buffer[elf_header.e_phoff]);
for (size_t header_index = 0; header_index < num_program_headers; ++header_index) {
auto& program_header = program_header_begin[header_index];
LibELF: Reject ELF with program header p_filesz larger than p_memsz
2020-12-27 22:01:56 +00:00
if (program_header.p_filesz > program_header.p_memsz) {
if (verbose)
dbgln("Program header ({}) has p_filesz ({}) larger than p_memsz ({})", header_index, program_header.p_filesz, program_header.p_memsz);
return false;
}
LibELF: validate_program_headers: Validate p_memsz and p_align
2021-01-01 02:36:55 +00:00
if (program_header.p_memsz <= 0 && (program_header.p_type == PT_TLS || program_header.p_type == PT_LOAD)) {
if (verbose)
dbgln("Program header ({}) has invalid size in memory ({})", header_index, program_header.p_memsz);
return false;
}
if (program_header.p_type == PT_LOAD && program_header.p_align != PAGE_SIZE) {
if (elf_header.e_type != ET_CORE) {
if (verbose)
dbgln("Program header ({}) with p_type PT_LOAD has p_align ({}) not equal to page size ({})", header_index, program_header.p_align, PAGE_SIZE);
return false;
}
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
switch (program_header.p_type) {
case PT_INTERP:
// We checked above that file_size was >= buffer size. We only care about buffer size anyway, we're trying to read this!
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
if (Checked<size_t>::addition_would_overflow(program_header.p_offset, program_header.p_filesz)) {
if (verbose)
dbgln("Integer overflow while validating PT_INTERP header");
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
if (program_header.p_offset + program_header.p_filesz > buffer_size) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-11-30 23:21:55 -07:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("Found PT_INTERP header ({}), but the .interp section was not within the buffer :(", header_index);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
LibELF: validate_program_headers: Validate PT_INTERP header p_filesz > 1
2021-01-16 17:35:46 +00:00
if (program_header.p_filesz <= 1) {
if (verbose)
dbgln("Found PT_INTERP header ({}), but p_filesz is invalid ({})", header_index, program_header.p_filesz);
return false;
}
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-11-30 23:21:55 -07:00
if (interpreter_path)
*interpreter_path = String((const char*)&buffer[program_header.p_offset], program_header.p_filesz - 1);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
break;
case PT_LOAD:
case PT_DYNAMIC:
case PT_NOTE:
case PT_PHDR:
case PT_TLS:
LibELF: Add a bunch of overflow checks in ELF validation
2021-01-30 13:54:24 +01:00
if (Checked<size_t>::addition_would_overflow(program_header.p_offset, program_header.p_filesz)) {
if (verbose)
dbgln("Integer overflow while validating a program header");
return false;
}
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
if (program_header.p_offset + program_header.p_filesz > file_size) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-11-30 23:21:55 -07:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("SHENANIGANS! Program header {} segment leaks beyond end of file!", header_index);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
if ((program_header.p_flags & PF_X) && (program_header.p_flags & PF_W)) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-11-30 23:21:55 -07:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("SHENANIGANS! Program header {} segment is marked write and execute", header_index);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
break;
LibELF: Ignore PT_GNU_STACK headers We always map stacks R/W (never X), so we can just ignore this header as far as I understand.
2020-08-20 10:08:02 +02:00
case PT_GNU_STACK:
if (program_header.p_flags & PF_X) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-11-30 23:21:55 -07:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("Possible shenanigans! Validating an ELF with executable stack.");
LibELF: Ignore PT_GNU_STACK headers We always map stacks R/W (never X), so we can just ignore this header as far as I understand.
2020-08-20 10:08:02 +02:00
}
break;
LibELF: Validate PT_GNU_RELRO program header I'm not sure if this is the correct validation. This is based on it being "read-only after relocation".
2020-09-09 08:40:17 +01:00
case PT_GNU_RELRO:
if ((program_header.p_flags & PF_X) && (program_header.p_flags & PF_W)) {
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-11-30 23:21:55 -07:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("SHENANIGANS! Program header {} segment is marked write and execute", header_index);
LibELF: Validate PT_GNU_RELRO program header I'm not sure if this is the correct validation. This is based on it being "read-only after relocation".
2020-09-09 08:40:17 +01:00
return false;
}
break;
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
default:
// Not handling other program header types in other code so... let's not surprise them
LibELF+Kernel: Validate program headers in Image::parse This should catch more malformed ELF files earlier than simply checking the ELF header alone. Also change the API of validate_program_headers to take the interpreter_path by pointer. This makes it less awkward to call when we don't care about the interpreter, and just want the validation.
2020-11-30 23:21:55 -07:00
if (verbose)
LibELF: Convert many dbgprintf() to dbgln() and tweak debug macro name
2021-01-10 09:33:56 +01:00
dbgln("Found program header ({}) of unrecognized type {}!", header_index, program_header.p_type);
LibELF: Move validation methods to their own file These validate_elf_* methods really had no business being static methods of ELF::Image. Now that the ELF namespace exists, it makes sense to just move them to be free functions in the namespace.
2020-04-11 12:32:38 -06:00
return false;
}
}
return true;
}
} // end namespace ELF
Reference in a new issue Copy permalink