mirror of
https://github.com/jedisct1/libsodium.git
synced 2026-08-25 08:37:13 +09:00
Frank Denis
473e1718cc
ptr = sodium_malloc(size) returns a pointer from which exactly "size" bytes can be accessed. ptr = sodium_allocarray(count, size) allocates enough storage space for "count" pointers or scalars of unit size "size". In both cases, the region is immediately followed by a guard page. As a result, any attempt to access a memory location after ptr[size - 1] will immediately trigger a segmentation fault. The allocated region is mlock()ed and filled with 0xd0 bytes. A read-only page with the size, a guard page, as well as a canary are placed before the returned pointer. The canary is checked by sodium_free(); as a result, altering data right before ptr is likely to cause sodium_free() to kill the process. sodium_free() munlock()s the region and fills it with zeros before actually calling free(). sodium_mprotect_noaccess(), sodium_mprotect_readonly() and sodium_mprotect_readwrite() can be used to change the protection on the set of allocated pages. Reverting the protection to read+write is not required before calling sodium_free().
71 lines
1.4 KiB
C
71 lines
1.4 KiB
C
|
|
#include <sys/types.h>
|
|
|
|
#include <limits.h>
|
|
#include <signal.h>
|
|
#include <string.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
|
|
#define TEST_NAME "sodium_utils2"
|
|
#include "cmptest.h"
|
|
|
|
static void
|
|
segv_handler(int sig)
|
|
{
|
|
printf("Intentional segfault / bus error caught\n");
|
|
printf("OK\n");
|
|
#ifdef SIGSEGV
|
|
signal(SIGSEGV, SIG_DFL);
|
|
#endif
|
|
#ifdef SIGBUS
|
|
signal(SIGBUS, SIG_DFL);
|
|
#endif
|
|
#ifdef SIGABRT
|
|
signal(SIGABRT, SIG_DFL);
|
|
#endif
|
|
exit(0);
|
|
}
|
|
|
|
int
|
|
main(void)
|
|
{
|
|
void *buf;
|
|
size_t size;
|
|
unsigned int i;
|
|
|
|
if (sodium_allocarray(SIZE_MAX / 2U + 1U, SIZE_MAX / 2U) != NULL) {
|
|
return 1;
|
|
}
|
|
sodium_free(sodium_malloc(0U));
|
|
sodium_free(NULL);
|
|
for (i = 0U; i < 10000U; i++) {
|
|
size = randombytes_uniform(100000U);
|
|
buf = sodium_malloc(size);
|
|
memset(buf, i, size);
|
|
sodium_mprotect_readonly(buf);
|
|
sodium_free(buf);
|
|
}
|
|
printf("OK\n");
|
|
|
|
#ifdef SIGSEGV
|
|
signal(SIGSEGV, segv_handler);
|
|
#endif
|
|
#ifdef SIGBUS
|
|
signal(SIGBUS, segv_handler);
|
|
#endif
|
|
#ifdef SIGABRT
|
|
signal(SIGABRT, segv_handler);
|
|
#endif
|
|
size = randombytes_uniform(100000U);
|
|
buf = sodium_malloc(size);
|
|
sodium_mprotect_readonly(buf);
|
|
sodium_mprotect_readwrite(buf);
|
|
sodium_memzero(((unsigned char *) buf) + size, 1U);
|
|
sodium_mprotect_noaccess(buf);
|
|
sodium_free(buf);
|
|
printf("Overflow not caught\n");
|
|
|
|
return 0;
|
|
}
|