883ef2499c
I accidentally did a signed comparison of the size_t values passed in for three of the _chk functions. Changing them to unsigned compares. Add three new tests to verify this failure is fixed. Bug: 10691831 Change-Id: Ia831071f7dffd5972a748d888dd506c7cc7ddba3
92 lines
2.8 KiB
ArmAsm
92 lines
2.8 KiB
ArmAsm
/*
|
|
* Copyright (C) 2013 The Android Open Source Project
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* * Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* * Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in
|
|
* the documentation and/or other materials provided with the
|
|
* distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
|
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
|
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
|
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
|
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
|
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
|
|
/* Assumes neon instructions and a cache line size of 32 bytes. */
|
|
|
|
#include <machine/asm.h>
|
|
#include "libc_events.h"
|
|
|
|
/*
|
|
* This code assumes it is running on a processor that supports all arm v7
|
|
* instructions, that supports neon instructions, and that has a 32 byte
|
|
* cache line.
|
|
*/
|
|
|
|
.text
|
|
.syntax unified
|
|
.fpu neon
|
|
.thumb
|
|
.thumb_func
|
|
|
|
ENTRY(__memcpy_chk)
|
|
.cfi_startproc
|
|
cmp r2, r3
|
|
bhi __memcpy_chk_fail
|
|
|
|
// Fall through to memcpy...
|
|
.cfi_endproc
|
|
END(__memcpy_chk)
|
|
|
|
ENTRY(memcpy)
|
|
.cfi_startproc
|
|
pld [r1, #64]
|
|
stmfd sp!, {r0, lr}
|
|
.save {r0, lr}
|
|
.cfi_def_cfa_offset 8
|
|
.cfi_rel_offset r0, 0
|
|
.cfi_rel_offset lr, 4
|
|
.cfi_endproc
|
|
END(memcpy)
|
|
|
|
#define MEMCPY_BASE __memcpy_base
|
|
#define MEMCPY_BASE_ALIGNED __memcpy_base_aligned
|
|
#include "memcpy_base.S"
|
|
|
|
ENTRY(__memcpy_chk_fail)
|
|
.cfi_startproc
|
|
// Preserve lr for backtrace.
|
|
push {lr}
|
|
.save {lr}
|
|
.cfi_def_cfa_offset 4
|
|
.cfi_rel_offset lr, 0
|
|
|
|
ldr r0, error_message
|
|
ldr r1, error_code
|
|
1:
|
|
add r0, pc
|
|
bl __fortify_chk_fail
|
|
error_code:
|
|
.word BIONIC_EVENT_MEMCPY_BUFFER_OVERFLOW
|
|
error_message:
|
|
.word error_string-(1b+4)
|
|
.cfi_endproc
|
|
END(__memcpy_chk_fail)
|
|
|
|
.data
|
|
error_string:
|
|
.string "memcpy buffer overflow"
|