From b7839b19654ad44b883ab527d88bcd5596bf2974 Mon Sep 17 00:00:00 2001 From: dhartmei <> Date: Mon, 29 Jul 2002 19:54:42 +0000 Subject: [PATCH] Replace atexit handler. mprotect() the pages so an attempt to modify the function pointers from the outside will segfault. Idea, hints and feedback from deraadt. ok deraadt. --- src/lib/libc/stdlib/atexit.c | 81 ++++++++++++++++++++---------------- src/lib/libc/stdlib/atexit.h | 56 ++++++++++++------------- src/lib/libc/stdlib/exit.c | 21 +++++++--- 3 files changed, 87 insertions(+), 71 deletions(-) diff --git a/src/lib/libc/stdlib/atexit.c b/src/lib/libc/stdlib/atexit.c index c0fb6241..55425336 100644 --- a/src/lib/libc/stdlib/atexit.c +++ b/src/lib/libc/stdlib/atexit.c @@ -1,46 +1,43 @@ -/*- - * Copyright (c) 1990 The Regents of the University of California. +/* + * Copyright (c) 2002 Daniel Hartmeier * All rights reserved. * - * This code is derived from software contributed to Berkeley by - * Chris Torek. - * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * This product includes software developed by the University of - * California, Berkeley and its contributors. - * 4. Neither the name of the University nor the names of its contributors - * may be used to endorse or promote products derived from this software - * without specific prior written permission. * - * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. + * - Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * - Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following + * disclaimer in the documentation and/or other materials provided + * with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN + * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + * */ #if defined(LIBC_SCCS) && !defined(lint) -static char *rcsid = "$OpenBSD: atexit.c,v 1.2 1996/08/19 08:33:22 tholo Exp $"; +static char *rcsid = "$OpenBSD: atexit.c,v 1.3 2002/07/29 19:54:42 dhartmei Exp $"; #endif /* LIBC_SCCS and not lint */ +#include +#include #include #include "atexit.h" +int __atexit_invalid = 1; struct atexit *__atexit; /* @@ -50,18 +47,32 @@ int atexit(fn) void (*fn)(); { - static struct atexit __atexit0; /* one guaranteed table */ - register struct atexit *p; + register struct atexit *p = __atexit; + register int pgsize = getpagesize(); - if ((p = __atexit) == NULL) - __atexit = p = &__atexit0; - else if (p->ind >= ATEXIT_SIZE) { - if ((p = malloc(sizeof(*p))) == NULL) + if (pgsize < sizeof(*p)) + return (-1); + if (p != NULL) { + if (p->ind + 1 >= p->max) + p = NULL; + else if (mprotect(p, pgsize, PROT_READ | PROT_WRITE)) + return (-1); + } + if (p == NULL) { + p = mmap(NULL, pgsize, PROT_READ | PROT_WRITE, + MAP_ANON | MAP_PRIVATE, -1, 0); + if (p == MAP_FAILED) return (-1); p->ind = 0; + p->max = (pgsize - ((char *)&p->fns[0] - (char *)p)) / + sizeof(p->fns[0]); p->next = __atexit; __atexit = p; + if (__atexit_invalid) + __atexit_invalid = 0; } p->fns[p->ind++] = fn; + if (mprotect(p, pgsize, PROT_READ)) + return (-1); return (0); } diff --git a/src/lib/libc/stdlib/atexit.h b/src/lib/libc/stdlib/atexit.h index e41a7cb8..6424dfdb 100644 --- a/src/lib/libc/stdlib/atexit.h +++ b/src/lib/libc/stdlib/atexit.h @@ -1,45 +1,41 @@ -/*- - * Copyright (c) 1990 The Regents of the University of California. +/* $OpenBSD: atexit.h,v 1.3 2002/07/29 19:54:42 dhartmei Exp $ */ + +/* + * Copyright (c) 2002 Daniel Hartmeier * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in the - * documentation and/or other materials provided with the distribution. - * 3. All advertising materials mentioning features or use of this software - * must display the following acknowledgement: - * This product includes software developed by the University of - * California, Berkeley and its contributors. - * 4. Neither the name of the University nor the names of its contributors - * may be used to endorse or promote products derived from this software - * without specific prior written permission. * - * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND - * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE - * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE - * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE - * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL - * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS - * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT - * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY - * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF - * SUCH DAMAGE. + * - Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * - Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the following + * disclaimer in the documentation and/or other materials provided + * with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER + * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT + * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN + * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. * - * $OpenBSD: atexit.h,v 1.2 1996/08/19 08:33:23 tholo Exp $ */ -/* must be at least 32 to guarantee ANSI conformance */ -#define ATEXIT_SIZE 32 - struct atexit { struct atexit *next; /* next in list */ int ind; /* next index in this table */ - void (*fns[ATEXIT_SIZE])(); /* the table itself */ + int max; /* max entries >= ATEXIT_SIZE */ + void (*fns[1])(); /* the table itself */ }; +extern int __atexit_invalid; extern struct atexit *__atexit; /* points to head of LIFO stack */ diff --git a/src/lib/libc/stdlib/exit.c b/src/lib/libc/stdlib/exit.c index ab53f940..c16b33bd 100644 --- a/src/lib/libc/stdlib/exit.c +++ b/src/lib/libc/stdlib/exit.c @@ -32,9 +32,11 @@ */ #if defined(LIBC_SCCS) && !defined(lint) -static char *rcsid = "$OpenBSD: exit.c,v 1.4 2000/01/06 08:45:50 d Exp $"; +static char *rcsid = "$OpenBSD: exit.c,v 1.5 2002/07/29 19:54:42 dhartmei Exp $"; #endif /* LIBC_SCCS and not lint */ +#include +#include #include #include #include "atexit.h" @@ -58,12 +60,19 @@ void exit(status) int status; { - register struct atexit *p; - register int n; + register struct atexit *p, *q; + register int n, pgsize = getpagesize(); - for (p = __atexit; p; p = p->next) - for (n = p->ind; --n >= 0;) - (*p->fns[n])(); + if (!__atexit_invalid) { + p = __atexit; + while (p != NULL) { + for (n = p->ind; --n >= 0;) + (*p->fns[n])(); + q = p; + p = p->next; + munmap(q, pgsize); + } + } if (__cleanup) (*__cleanup)(); _exit(status);