mirror of
https://github.com/jart/cosmopolitan.git
synced 2025-07-12 14:09:12 +00:00
Make C memory safe like Rust
This change enables Address Sanitizer systemically w/ `make MODE=dbg`. Our version of Rust's `unsafe` keyword is named `noasan` which is used for two functions that do aligned memory chunking, like `strcpy.c` and we need to fix the tiny DEFLATE code, but that's it everything else is fabulous you can have all the fischer price security blankets you need Best of all is we're now able to use the ASAN data in Blinkenlights to colorize the memory dumps. See the screenshot below of a test program: https://justine.lol/blinkenlights/asan.png Which is operating on float arrays stored on the stack, with red areas indicating poisoned memory, and the green areas indicate valid memory.
This commit is contained in:
Justine Tunney
parent
fdc3fa9148
commit
1ff9ab95ac
153 changed files with 2545 additions and 2077 deletions
|
|
@ -37,8 +37,8 @@ testonly void testlib_runfixtures(testfn_t *test_start, testfn_t *test_end,
|
|||
unsigned i, count;
|
||||
count = testlib_countfixtures(fixture_start, fixture_end);
|
||||
for (i = 0; i < count && !g_testlib_failed; ++i) {
|
||||
snprintf(g_fixturename, sizeof(g_fixturename), "%s_%s",
|
||||
fixture_start[i].group, fixture_start[i].name);
|
||||
(snprintf)(g_fixturename, sizeof(g_fixturename), "%s_%s",
|
||||
fixture_start[i].group, fixture_start[i].name);
|
||||
_piro(PROT_READ | PROT_WRITE);
|
||||
fixture_start[i].fn();
|
||||
_piro(PROT_READ);
|
||||
|
|
|
|||
|
|
@ -233,71 +233,6 @@ COSMOPOLITAN_C_START_
|
|||
#define EXPECT_LGBL_LT(VAL, GOT) \
|
||||
expectLongDoubleLessThan(VAL, GOT, #VAL " < " #GOT, false)
|
||||
|
||||
/*───────────────────────────────────────────────────────────────────────────│─╗
|
||||
│ cosmopolitan § testing library » hardware-accelerated memory safety ─╬─│┼
|
||||
╚────────────────────────────────────────────────────────────────────────────│*/
|
||||
|
||||
typedef void (*testfn_t)(void);
|
||||
|
||||
struct TestFixture {
|
||||
const char *group;
|
||||
const char *name;
|
||||
testfn_t fn;
|
||||
};
|
||||
|
||||
struct TestAllocation {
|
||||
void *mapaddr;
|
||||
size_t mapsize;
|
||||
void *useraddr;
|
||||
size_t usersize;
|
||||
};
|
||||
|
||||
struct TestMemoryStack {
|
||||
size_t i;
|
||||
size_t n;
|
||||
struct TestAllocation *p;
|
||||
};
|
||||
|
||||
extern struct TestMemoryStack g_testmem;
|
||||
|
||||
void tfree(void *) paramsnonnull();
|
||||
void *tmalloc(size_t) returnsnonnull returnspointerwithnoaliases nodiscard
|
||||
attributeallocsize((1)) returnsaligned((1));
|
||||
void *tmemalign(size_t,
|
||||
size_t) returnsnonnull returnspointerwithnoaliases nodiscard
|
||||
attributeallocsize((2)) libcesque attributeallocalign((1));
|
||||
char *tstrdup(const char *) returnsnonnull returnspointerwithnoaliases nodiscard
|
||||
returnsaligned((1));
|
||||
void *tunbing(const char16_t *)
|
||||
paramsnonnull() returnsnonnull returnspointerwithnoaliases nodiscard
|
||||
returnsaligned((1));
|
||||
void *tunbinga(size_t, const char16_t *)
|
||||
paramsnonnull() returnsnonnull returnspointerwithnoaliases nodiscard
|
||||
attributeallocalign((1));
|
||||
void testlib_clearxmmregisters(void);
|
||||
|
||||
#define tgc(TMEM) \
|
||||
({ \
|
||||
void *Res; \
|
||||
/* volatile b/c testmem only lifo atm */ \
|
||||
asm volatile("" ::: "memory"); \
|
||||
Res = defer((tfree), (TMEM)); \
|
||||
asm volatile("" ::: "memory"); \
|
||||
Res; \
|
||||
})
|
||||
|
||||
#define tfree(P) \
|
||||
do { \
|
||||
__tfree_check(P); \
|
||||
(tfree)(P); \
|
||||
} while (0)
|
||||
|
||||
#define __tfree_check(P) \
|
||||
ASSERT_BETWEEN(g_testmem.p[g_testmem.i - 1].useraddr, \
|
||||
((char *)g_testmem.p[g_testmem.i - 1].useraddr + \
|
||||
g_testmem.p[g_testmem.i - 1].usersize), \
|
||||
P)
|
||||
|
||||
/*───────────────────────────────────────────────────────────────────────────│─╗
|
||||
│ cosmopolitan § testing library » implementation details ─╬─│┼
|
||||
╚────────────────────────────────────────────────────────────────────────────│*/
|
||||
|
|
@ -310,6 +245,14 @@ void testlib_clearxmmregisters(void);
|
|||
const char *file; \
|
||||
int line
|
||||
|
||||
typedef void (*testfn_t)(void);
|
||||
|
||||
struct TestFixture {
|
||||
const char *group;
|
||||
const char *name;
|
||||
testfn_t fn;
|
||||
};
|
||||
|
||||
extern char g_fixturename[256];
|
||||
extern bool g_testlib_shoulddebugbreak; /* set by testmain */
|
||||
extern unsigned g_testlib_ran; /* set by wrappers */
|
||||
|
|
@ -374,6 +317,7 @@ void testlib_formatbinaryasglyphs(const char16_t *, const void *, size_t,
|
|||
char **, char **);
|
||||
bool testlib_almostequallongdouble(long double, long double);
|
||||
void testlib_incrementfailed(void);
|
||||
void testlib_clearxmmregisters(void);
|
||||
|
||||
forceinline void testlib_ontest() {
|
||||
YOINK(__testcase_start);
|
||||
|
|
|
|||
|
|
@ -56,7 +56,6 @@ LIBC_TESTLIB_A_SRCS_C = \
|
|||
libc/testlib/shoulddebugbreak.c \
|
||||
libc/testlib/showerror.c \
|
||||
libc/testlib/showerror_.c \
|
||||
libc/testlib/testmem.c \
|
||||
libc/testlib/strequals.c \
|
||||
libc/testlib/startswith.c \
|
||||
libc/testlib/endswith.c \
|
||||
|
|
|
|||
|
|
@ -1,179 +0,0 @@
|
|||
/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
|
||||
│vi: set net ft=c ts=2 sts=2 sw=2 fenc=utf-8 :vi│
|
||||
╞══════════════════════════════════════════════════════════════════════════════╡
|
||||
│ Copyright 2020 Justine Alexandra Roberts Tunney │
|
||||
│ │
|
||||
│ Permission to use, copy, modify, and/or distribute this software for │
|
||||
│ any purpose with or without fee is hereby granted, provided that the │
|
||||
│ above copyright notice and this permission notice appear in all copies. │
|
||||
│ │
|
||||
│ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL │
|
||||
│ WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED │
|
||||
│ WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE │
|
||||
│ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL │
|
||||
│ DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR │
|
||||
│ PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER │
|
||||
│ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR │
|
||||
│ PERFORMANCE OF THIS SOFTWARE. │
|
||||
╚─────────────────────────────────────────────────────────────────────────────*/
|
||||
#include "libc/assert.h"
|
||||
#include "libc/bits/safemacros.h"
|
||||
#include "libc/calls/calls.h"
|
||||
#include "libc/dce.h"
|
||||
#include "libc/fmt/bing.internal.h"
|
||||
#include "libc/limits.h"
|
||||
#include "libc/log/check.h"
|
||||
#include "libc/log/log.h"
|
||||
#include "libc/macros.h"
|
||||
#include "libc/mem/mem.h"
|
||||
#include "libc/runtime/sysconf.h"
|
||||
#include "libc/str/str.h"
|
||||
#include "libc/sysv/consts/map.h"
|
||||
#include "libc/sysv/consts/prot.h"
|
||||
#include "libc/testlib/testlib.h"
|
||||
|
||||
/* TODO(jart): DELETE */
|
||||
|
||||
struct TestMemoryStack g_testmem;
|
||||
struct TestMemoryStack g_testmem_trash;
|
||||
static struct TestAllocation g_testmem_scratch[2][8];
|
||||
static const char kMemZero[1];
|
||||
static bool g_atstartofpage;
|
||||
|
||||
static struct TestAllocation testmem_push(struct TestMemoryStack *stack,
|
||||
struct TestAllocation entry) {
|
||||
if (stack->i == stack->n) {
|
||||
if (!__grow(&stack->p, &stack->n, sizeof(struct TestAllocation), 0)) {
|
||||
abort();
|
||||
}
|
||||
}
|
||||
return (stack->p[stack->i++] = entry);
|
||||
}
|
||||
|
||||
static struct TestAllocation testmem_pop(struct TestMemoryStack *stack) {
|
||||
assert(stack->i > 0);
|
||||
struct TestAllocation res = stack->p[--stack->i];
|
||||
return res;
|
||||
}
|
||||
|
||||
static void testmem_destroy(struct TestAllocation alloc) {
|
||||
if (munmap(alloc.mapaddr, alloc.mapsize) == -1) perror("munmap"), __die();
|
||||
}
|
||||
|
||||
static struct TestAllocation talloc(size_t n) {
|
||||
struct TestAllocation alloc;
|
||||
if (n) {
|
||||
while (g_testmem_trash.i) {
|
||||
struct TestAllocation trash = testmem_pop(&g_testmem_trash);
|
||||
if (n <= trash.usersize) {
|
||||
return trash;
|
||||
} else {
|
||||
testmem_destroy(trash);
|
||||
}
|
||||
}
|
||||
alloc.mapsize = ROUNDUP(n + PAGESIZE * 2, FRAMESIZE);
|
||||
CHECK_NE(MAP_FAILED, (alloc.mapaddr = mapanon(alloc.mapsize)));
|
||||
CHECK_NE(-1, mprotect(alloc.mapaddr, PAGESIZE, PROT_NONE));
|
||||
CHECK_NE(-1, mprotect((char *)alloc.mapaddr + alloc.mapsize - PAGESIZE,
|
||||
PAGESIZE, PROT_NONE));
|
||||
alloc.useraddr = (char *)alloc.mapaddr + PAGESIZE;
|
||||
alloc.usersize = alloc.mapsize - PAGESIZE * 2;
|
||||
CHECK_GE(alloc.usersize, n);
|
||||
return alloc;
|
||||
} else {
|
||||
alloc.mapaddr = (/*unconst*/ void *)kMemZero;
|
||||
alloc.mapsize = 0;
|
||||
alloc.useraddr = (/*unconst*/ void *)kMemZero;
|
||||
alloc.usersize = 0;
|
||||
return alloc;
|
||||
}
|
||||
}
|
||||
|
||||
static textstartup void testmem_init(void) {
|
||||
g_testmem.p = g_testmem_scratch[0];
|
||||
g_testmem.n = ARRAYLEN(g_testmem_scratch[0]);
|
||||
g_testmem_trash.p = g_testmem_scratch[1];
|
||||
g_testmem_trash.n = ARRAYLEN(g_testmem_scratch[1]);
|
||||
}
|
||||
|
||||
const void *const testmem_ctor[] initarray = {testmem_init};
|
||||
|
||||
FIXTURE(testmemory, triggerOffByOneArrayErrors) {
|
||||
/* automate testing buffer overflows *and* underflows */
|
||||
g_atstartofpage = true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Allocates memory with properties useful for testing.
|
||||
*
|
||||
* This returns a pointer 𝑝 where reading or writing to either 𝑝[-1] or
|
||||
* 𝑝[𝑛+𝟷] will immediately trigger a segmentation fault; and bytes are
|
||||
* initialized to 10100101 (A5).
|
||||
*
|
||||
* Implementation Details: Accomplishing this entails two things. First,
|
||||
* we grant each allocation a page granular memory mapping, with access
|
||||
* to the two adjacent pages disabled. Second, since hardware memory
|
||||
* protection isn't 1-byte granular, we add a fixture so each test runs
|
||||
* a second time; the first call we return a pointer where the data is
|
||||
* placed on the righthand side, and the second call we return the data
|
||||
* on the lefthand side, thereby allowing both underflow/overflow
|
||||
* off-by-one out-of-bounds accesses to be detected.
|
||||
*/
|
||||
void *tmalloc(size_t n) {
|
||||
struct TestAllocation alloc = talloc(n);
|
||||
memset(alloc.useraddr, 0xa5, alloc.usersize);
|
||||
testmem_push(&g_testmem, alloc);
|
||||
return (char *)alloc.useraddr + (g_atstartofpage ? 0 : alloc.usersize - n);
|
||||
}
|
||||
|
||||
/**
|
||||
* Same as tmalloc() but guarantees a specific alignment.
|
||||
*
|
||||
* Reading or writing to either 𝑝[-1] or 𝑝[roundup(𝑛+𝟷,𝑎)] will
|
||||
* immediately trigger a segmentation fault.
|
||||
*
|
||||
* @param 𝑎 is alignment in bytes, e.g. 16
|
||||
* @param 𝑛 is number of bytes
|
||||
*/
|
||||
void *tmemalign(size_t a, size_t n) {
|
||||
/* TODO(jart): ASAN detect 𝑝[𝑛+𝟷] */
|
||||
return tmalloc(ROUNDUP(n, a));
|
||||
}
|
||||
|
||||
/**
|
||||
* Same as tunbing() w/ alignment guarantee.
|
||||
*/
|
||||
void *tunbinga(size_t a, const char16_t *binglyphs) {
|
||||
size_t size;
|
||||
EXPECT_NE(0, (size = strlen16(binglyphs)));
|
||||
return unbingbuf(tmemalign(a, size), size, binglyphs, -1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Decodes CP437 glyphs to bounds-checked binary buffer, e.g.
|
||||
*
|
||||
* char *mem = tunbing(u" ☺☻♥♦");
|
||||
* EXPECT_EQ(0, memcmp("\0\1\2\3\4", mem, 5));
|
||||
* tfree(mem);
|
||||
*
|
||||
* @see tunbing(), unbingstr(), unbing()
|
||||
*/
|
||||
void *tunbing(const char16_t *binglyphs) {
|
||||
return tunbinga(1, binglyphs);
|
||||
}
|
||||
|
||||
/**
|
||||
* Frees memory allocated with tmalloc().
|
||||
* This needs to be called in LIFO order.
|
||||
* @param
|
||||
*/
|
||||
void(tfree)(void *p) {
|
||||
struct TestAllocation alloc;
|
||||
__tfree_check(p);
|
||||
alloc = testmem_pop(&g_testmem);
|
||||
if (alloc.mapsize) testmem_push(&g_testmem_trash, alloc);
|
||||
}
|
||||
|
||||
char *tstrdup(const char *s) {
|
||||
return strcpy(tmalloc(strlen(s) + 1), s);
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue