summary |
shortlog |
log |
commit | commitdiff |
tree
raw |
patch |
inline | side by side (from parent 1:
7496c9f)
Reject specialized load instructions so a bytecode crafted with
nefarious intent cannot read a memory area larger than the memory
targeted by the instrumentation.
This prevents bytecode received from the session daemon from performing
out of bound memory accesses and from disclosing the content of
application memory beyond what has been targeted by the instrumentation.
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Change-Id: Id81d73e890b29fe2ac6073681ef1faffc52ebfa7
dbg_printf("Validate load field\n");
break;
}
dbg_printf("Validate load field\n");
break;
}
+
+ /*
+ * Disallow already specialized bytecode op load field instructions to
+ * ensure that the received bytecode does not read a memory area larger
+ * than the memory targeted by the instrumentation.
+ */
case FILTER_OP_LOAD_FIELD_S8:
case FILTER_OP_LOAD_FIELD_S8:
- {
- dbg_printf("Validate load field s8\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_S16:
case FILTER_OP_LOAD_FIELD_S16:
- {
- dbg_printf("Validate load field s16\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_S32:
case FILTER_OP_LOAD_FIELD_S32:
- {
- dbg_printf("Validate load field s32\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_S64:
case FILTER_OP_LOAD_FIELD_S64:
- {
- dbg_printf("Validate load field s64\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_U8:
case FILTER_OP_LOAD_FIELD_U8:
- {
- dbg_printf("Validate load field u8\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_U16:
case FILTER_OP_LOAD_FIELD_U16:
- {
- dbg_printf("Validate load field u16\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_U32:
case FILTER_OP_LOAD_FIELD_U32:
- {
- dbg_printf("Validate load field u32\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_U64:
case FILTER_OP_LOAD_FIELD_U64:
- {
- dbg_printf("Validate load field u64\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_STRING:
case FILTER_OP_LOAD_FIELD_STRING:
- {
- dbg_printf("Validate load field string\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_SEQUENCE:
case FILTER_OP_LOAD_FIELD_SEQUENCE:
- {
- dbg_printf("Validate load field sequence\n");
- break;
- }
case FILTER_OP_LOAD_FIELD_DOUBLE:
{
case FILTER_OP_LOAD_FIELD_DOUBLE:
{
- dbg_printf("Validate load field double\n");
- break;
+ dbg_printf("Validate load field, reject specialized load instruction (%d)\n",
+ (int) opcode);
+ ret = -EINVAL;
+ goto end;
}
case FILTER_OP_GET_SYMBOL:
}
case FILTER_OP_GET_SYMBOL: