Changeset 138293 in webkit

Timestamp:

Dec 20, 2012, 1:35:56 PM (12 years ago)

Author:

oliver@apple.com

Message:

Harden pointers in FastMalloc's singly linked list implementation
​https://bugs.webkit.org/show_bug.cgi?id=105571

Reviewed by Gavin Barraclough.

Add simple xor based hardening of the next pointer in the
fast malloc singly linked list implementation. We rely on
ASLR to introduce the address randomness we want for the mask.
Happily this produces a very low cost random value to use.

• wtf/FastMalloc.cpp:

(WTF):
(WTF::SLL_Next):
(WTF::SLL_SetNext):

Location:

trunk/Source/WTF

Files:

• ChangeLog (modified) (1 diff)
• wtf/FastMalloc.cpp (modified) (3 diffs)

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2012-12-20  Oliver Hunt  <oliver@apple.com>
+
+        Harden pointers in FastMalloc's singly linked list implementation
+        https://bugs.webkit.org/show_bug.cgi?id=105571
+
+        Reviewed by Gavin Barraclough.
+
+        Add simple xor based hardening of the next pointer in the
+        fast malloc singly linked list implementation.  We rely on
+        ASLR to introduce the address randomness we want for the mask.
+        Happily this produces a very low cost random value to use.
+
+        * wtf/FastMalloc.cpp:
+        (WTF):
+        (WTF::SLL_Next):
+        (WTF::SLL_SetNext):
+
 2012-12-19  Oliver Hunt  <oliver@apple.com>
 

trunk/Source/WTF/wtf/FastMalloc.cpp

@@ -101 +101 @@
 #endif
 
+// Harden the pointers stored in the TCMalloc linked lists
+#if COMPILER(GCC)
+#define ENABLE_TCMALLOC_HARDENING 1
+#endif
+
 // Use a background thread to periodically scavenge memory to release back to the system
 #if PLATFORM(IOS)
@@ -496 +501 @@
 #define MESSAGE LOG_ERROR
 #define CHECK_CONDITION ASSERT
+
+#if ENABLE(TCMALLOC_HARDENING)
+/*
+ * To make it harder to exploit use-after free style exploits
+ * we mask the addresses we put into our linked lists with the
+ * address of kLLHardeningMask.  Due to ASLR the address of
+ * kLLHardeningMask should be sufficiently randomized to make direct
+ * freelist manipulation much more difficult.
+ */
+static const char kLLHardeningMask = 0;
+#define MASK_PTR(ptr) (reinterpret_cast<typeof(ptr)>(reinterpret_cast<uintptr_t>(ptr)^reinterpret_cast<uintptr_t>(&kLLHardeningMask)))
+#define UNMASK_PTR(ptr) (reinterpret_cast<typeof(ptr)>(reinterpret_cast<uintptr_t>(ptr)^reinterpret_cast<uintptr_t>(&kLLHardeningMask)))
+#else
+#define MASK_PTR(ptr) (ptr)
+#define UNMASK_PTR(ptr) (ptr)
+#endif
+
 
 //-------------------------------------------------------------------
@@ -663 +685 @@
 
 static inline void *SLL_Next(void *t) {
-  return *(reinterpret_cast<void**>(t));
+  return UNMASK_PTR(*(reinterpret_cast<void**>(t)));
 }
 
 static inline void SLL_SetNext(void *t, void *n) {
-  *(reinterpret_cast<void**>(t)) = n;
+  *(reinterpret_cast<void**>(t)) = MASK_PTR(n);
 }