Skip to content

Add more checks to enhance security (#446) #190

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 24, 2020
Merged

Add more checks to enhance security (#446) #190

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
135 changes: 105 additions & 30 deletions core/iwasm/aot/aot_runtime.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -643,6 +643,24 @@ create_exports(AOTModuleInstance *module_inst, AOTModule *module,
error_buf, error_buf_size);
}

static bool
clear_wasi_proc_exit_exception(AOTModuleInstance *module_inst)
{
#if WASM_ENABLE_LIBC_WASI != 0
const char *exception = aot_get_exception(module_inst);
if (exception && !strcmp(exception, "Exception: wasi proc exit")) {
/* The "wasi proc exit" exception is thrown by native lib to
let wasm app exit, which is a normal behavior, we clear
the exception here. */
aot_set_exception(module_inst, NULL);
return true;
}
return false;
#else
return false;
#endif
}

static bool
execute_post_inst_function(AOTModuleInstance *module_inst)
{
Expand Down Expand Up @@ -677,6 +695,7 @@ execute_start_function(AOTModuleInstance *module_inst)
u.f(exec_env);

wasm_exec_env_destroy(exec_env);
(void)clear_wasi_proc_exit_exception(module_inst);
return !aot_get_exception(module_inst);
}

Expand Down Expand Up @@ -974,6 +993,7 @@ touch_pages(uint8 *stack_min_addr, uint32 page_size)
sum += *(stack_min_addr + page_size - 1);
break;
}
*touch_addr = 0;
sum += *touch_addr;
}
return sum;
Expand Down Expand Up @@ -1011,7 +1031,7 @@ invoke_native_with_hw_bound_check(WASMExecEnv *exec_env, void *func_ptr,
if (!exec_env->jmpbuf_stack_top) {
/* Touch each stack page to ensure that it has been mapped: the OS may
lazily grow the stack mapping as a guard page is hit. */
touch_pages(stack_min_addr, page_size);
(void)touch_pages(stack_min_addr, page_size);
/* First time to call aot function, protect one page */
if (os_mprotect(stack_min_addr, page_size * guard_page_count,
MMAP_PROT_NONE) != 0) {
Expand Down Expand Up @@ -1106,6 +1126,8 @@ aot_call_function(WASMExecEnv *exec_env,
if (!ret || aot_get_exception(module_inst)) {
if (argv1 != argv1_buf)
wasm_runtime_free(argv1);
if (clear_wasi_proc_exit_exception(module_inst))
return true;
return false;
}

Expand Down Expand Up @@ -1134,6 +1156,8 @@ aot_call_function(WASMExecEnv *exec_env,
else {
ret = invoke_native_internal(exec_env, function->u.func.func_ptr,
func_type, NULL, NULL, argv, argc, argv);
if (clear_wasi_proc_exit_exception(module_inst))
return true;
return ret && !aot_get_exception(module_inst) ? true : false;
}
}
Expand Down Expand Up @@ -1377,10 +1401,15 @@ aot_validate_app_addr(AOTModuleInstance *module_inst,
{
AOTMemoryInstance *memory_inst = aot_get_default_memory(module_inst);

if (!memory_inst) {
goto fail;
}

/* integer overflow check */
if(app_offset + size < app_offset) {
goto fail;
}

if (app_offset + size <= memory_inst->memory_data_size) {
return true;
}
Expand All @@ -1393,8 +1422,12 @@ bool
aot_validate_native_addr(AOTModuleInstance *module_inst,
void *native_ptr, uint32 size)
{
uint8 *addr = (uint8 *)native_ptr;
AOTMemoryInstance *memory_inst = aot_get_default_memory(module_inst);
uint8 *addr = (uint8 *)native_ptr;

if (!memory_inst) {
goto fail;
}

/* integer overflow check */
if (addr + size < addr) {
Expand All @@ -1413,7 +1446,13 @@ void *
aot_addr_app_to_native(AOTModuleInstance *module_inst, uint32 app_offset)
{
AOTMemoryInstance *memory_inst = aot_get_default_memory(module_inst);
uint8 *addr = (uint8 *)memory_inst->memory_data.ptr + app_offset;
uint8 *addr;

if (!memory_inst) {
return NULL;
}

addr = (uint8 *)memory_inst->memory_data.ptr + app_offset;

if ((uint8 *)memory_inst->memory_data.ptr <= addr
&& addr < (uint8 *)memory_inst->memory_data_end.ptr)
Expand All @@ -1424,8 +1463,12 @@ aot_addr_app_to_native(AOTModuleInstance *module_inst, uint32 app_offset)
uint32
aot_addr_native_to_app(AOTModuleInstance *module_inst, void *native_ptr)
{
uint8 *addr = (uint8 *)native_ptr;
AOTMemoryInstance *memory_inst = aot_get_default_memory(module_inst);
uint8 *addr = (uint8 *)native_ptr;

if (!memory_inst) {
return 0;
}

if ((uint8 *)memory_inst->memory_data.ptr <= addr
&& addr < (uint8 *)memory_inst->memory_data_end.ptr)
Expand All @@ -1440,7 +1483,13 @@ aot_get_app_addr_range(AOTModuleInstance *module_inst,
uint32 *p_app_end_offset)
{
AOTMemoryInstance *memory_inst = aot_get_default_memory(module_inst);
uint32 memory_data_size = memory_inst->memory_data_size;
uint32 memory_data_size;

if (!memory_inst) {
return false;
}

memory_data_size = memory_inst->memory_data_size;

if (app_offset < memory_data_size) {
if (p_app_start_offset)
Expand All @@ -1458,8 +1507,12 @@ aot_get_native_addr_range(AOTModuleInstance *module_inst,
uint8 **p_native_start_addr,
uint8 **p_native_end_addr)
{
uint8 *addr = (uint8 *)native_ptr;
AOTMemoryInstance *memory_inst = aot_get_default_memory(module_inst);
uint8 *addr = (uint8 *)native_ptr;

if (!memory_inst) {
return false;
}

if ((uint8 *)memory_inst->memory_data.ptr <= addr
&& addr < (uint8 *)memory_inst->memory_data_end.ptr) {
Expand All @@ -1477,17 +1530,24 @@ bool
aot_enlarge_memory(AOTModuleInstance *module_inst, uint32 inc_page_count)
{
AOTMemoryInstance *memory_inst = aot_get_default_memory(module_inst);
uint32 num_bytes_per_page = memory_inst->num_bytes_per_page;
uint32 cur_page_count = memory_inst->cur_page_count;
uint32 max_page_count = memory_inst->max_page_count;
uint32 total_page_count = cur_page_count + inc_page_count;
uint32 total_size_old = memory_inst->memory_data_size;
uint64 total_size = (uint64)num_bytes_per_page * total_page_count;
uint32 heap_size = (uint32)((uint8 *)memory_inst->heap_data_end.ptr
- (uint8 *)memory_inst->heap_data.ptr);
uint8 *memory_data_old = (uint8 *)memory_inst->memory_data.ptr;
uint8 *heap_data_old = (uint8 *)memory_inst->heap_data.ptr;
uint8 *memory_data, *heap_data;
uint32 num_bytes_per_page, cur_page_count, max_page_count;
uint32 total_page_count, total_size_old, heap_size;
uint64 total_size;
uint8 *memory_data_old, *heap_data_old, *memory_data, *heap_data;

if (!memory_inst)
return false;

num_bytes_per_page = memory_inst->num_bytes_per_page;
cur_page_count = memory_inst->cur_page_count;
max_page_count = memory_inst->max_page_count;
total_page_count = cur_page_count + inc_page_count;
total_size_old = memory_inst->memory_data_size;
total_size = (uint64)num_bytes_per_page * total_page_count;
heap_size = (uint32)((uint8 *)memory_inst->heap_data_end.ptr
- (uint8 *)memory_inst->heap_data.ptr);
memory_data_old = (uint8 *)memory_inst->memory_data.ptr;
heap_data_old = (uint8 *)memory_inst->heap_data.ptr;

if (inc_page_count <= 0)
/* No need to enlarge memory */
Expand Down Expand Up @@ -1563,11 +1623,18 @@ bool
aot_enlarge_memory(AOTModuleInstance *module_inst, uint32 inc_page_count)
{
AOTMemoryInstance *memory_inst = aot_get_default_memory(module_inst);
uint32 num_bytes_per_page = memory_inst->num_bytes_per_page;
uint32 cur_page_count = memory_inst->cur_page_count;
uint32 max_page_count = memory_inst->max_page_count;
uint32 total_page_count = cur_page_count + inc_page_count;
uint64 total_size = (uint64)num_bytes_per_page * total_page_count;
uint32 num_bytes_per_page, cur_page_count, max_page_count;
uint32 total_page_count;
uint64 total_size;

if (!memory_inst)
return false;

num_bytes_per_page = memory_inst->num_bytes_per_page;
cur_page_count = memory_inst->cur_page_count;
max_page_count = memory_inst->max_page_count;
total_page_count = cur_page_count + inc_page_count;
total_size = (uint64)num_bytes_per_page * total_page_count;

if (inc_page_count <= 0)
/* No need to enlarge memory */
Expand Down Expand Up @@ -1802,6 +1869,8 @@ aot_call_indirect(WASMExecEnv *exec_env,
if (!ret || aot_get_exception(module_inst)) {
if (argv1 != argv1_buf)
wasm_runtime_free(argv1);
if (clear_wasi_proc_exit_exception(module_inst))
return true;
return false;
}

Expand Down Expand Up @@ -1829,9 +1898,12 @@ aot_call_indirect(WASMExecEnv *exec_env,
return true;
}
else {
return invoke_native_internal(exec_env, func_ptr,
func_type, signature, attachment,
argv, argc, argv);
ret = invoke_native_internal(exec_env, func_ptr,
func_type, signature, attachment,
argv, argc, argv);
if (clear_wasi_proc_exit_exception(module_inst))
return true;
return ret;
}
}

Expand Down Expand Up @@ -2013,15 +2085,15 @@ aot_get_module_mem_consumption(const AOTModule *module,
mem_conspn->data_segs_size += sizeof(AOTMemInitData);
}

mem_conspn->const_strs_size =
bh_hash_map_get_struct_size(module->const_str_set);

const_string_size = 0;
if (module->const_str_set) {
mem_conspn->const_strs_size =
bh_hash_map_get_struct_size(module->const_str_set);

const_string_size = 0;
bh_hash_map_traverse(module->const_str_set,
const_string_node_size_cb);
mem_conspn->const_strs_size += const_string_size;
}
mem_conspn->const_strs_size += const_string_size;

/* code size + literal size + object data section size */
mem_conspn->aot_code_size = module->code_size + module->literal_size
Expand Down Expand Up @@ -2065,6 +2137,9 @@ aot_get_module_inst_mem_consumption(const AOTModuleInstance *module_inst,
mem_inst->num_bytes_per_page * mem_inst->cur_page_count;
mem_conspn->app_heap_size =
mem_inst->heap_data_end.ptr - mem_inst->heap_data.ptr;
/* size of app heap structure */
mem_conspn->memories_size +=
mem_allocator_get_heap_struct_size();
}

mem_conspn->tables_size = sizeof(uint32) * module_inst->table_size;
Expand Down
16 changes: 8 additions & 8 deletions core/iwasm/common/arch/invokeNative_em64_simd.s
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,14 +41,14 @@ push_args:
loop push_args
push_args_end:
/* fill all fp args */
movdqa 0x00(%rsi), %xmm0
movdqa 0x10(%rsi), %xmm1
movdqa 0x20(%rsi), %xmm2
movdqa 0x30(%rsi), %xmm3
movdqa 0x40(%rsi), %xmm4
movdqa 0x50(%rsi), %xmm5
movdqa 0x60(%rsi), %xmm6
movdqa 0x70(%rsi), %xmm7
movdqu 0x00(%rsi), %xmm0
movdqu 0x10(%rsi), %xmm1
movdqu 0x20(%rsi), %xmm2
movdqu 0x30(%rsi), %xmm3
movdqu 0x40(%rsi), %xmm4
movdqu 0x50(%rsi), %xmm5
movdqu 0x60(%rsi), %xmm6
movdqu 0x70(%rsi), %xmm7

/* fill all int args */
movq 0x80(%rsi), %rdi
Expand Down
21 changes: 14 additions & 7 deletions core/iwasm/common/wasm_c_api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -579,8 +579,10 @@ wasm_functype_new(wasm_valtype_vec_t *params, wasm_valtype_vec_t *results)

failed:
LOG_DEBUG("%s failed", __FUNCTION__);
FREEIF(func_type->params);
FREEIF(func_type->results);
if (func_type)
FREEIF(func_type->params);
if (func_type)
FREEIF(func_type->results);
FREEIF(func_type);
return NULL;
}
Expand Down Expand Up @@ -1151,10 +1153,15 @@ native_func_trampoline(wasm_exec_env_t exec_env, uint64 *argv)
}

if (trap) {
wasm_name_t *message = NULL;
wasm_trap_message(trap, message);
LOG_WARNING("got a trap %s", message->data);
wasm_name_delete(message);
wasm_name_t *message = malloc_internal(sizeof(wasm_name_t));
if (message) {
wasm_trap_message(trap, message);
if (message->data) {
LOG_WARNING("got a trap %s", message->data);
wasm_name_delete(message);
}
FREEIF(message);
}
}

/* there is no result or there is an exception */
Expand Down Expand Up @@ -2188,7 +2195,7 @@ interp_process_export(wasm_store_t *store,
uint32 export_cnt = 0;
uint32 i = 0;

bh_assert(store && inst_interp && externals);
bh_assert(store && inst_interp && inst_interp->module && externals);

exports = inst_interp->module->exports;
export_cnt = inst_interp->module->export_count;
Expand Down
12 changes: 11 additions & 1 deletion core/iwasm/common/wasm_runtime_common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2094,6 +2094,11 @@ wasm_application_execute_main(WASMModuleInstanceCommon *module_inst,
func_type = ((AOTFunctionInstance*)func)->u.func.func_type;
#endif

if (!func_type) {
LOG_ERROR("invalid module instance type");
return false;
}

if (!check_main_func_type(func_type)) {
wasm_runtime_set_exception(module_inst,
"invalid function type of main function");
Expand Down Expand Up @@ -2318,7 +2323,7 @@ wasm_application_execute_func(WASMModuleInstanceCommon *module_inst,
{
WASMFunctionInstanceCommon *func;
WASMType *type = NULL;
uint32 argc1, *argv1 = NULL, cell_num, j, k = 0;
uint32 argc1, *argv1 = NULL, cell_num = 0, j, k = 0;
int32 i, p;
uint64 total_size;
const char *exception;
Expand Down Expand Up @@ -2362,6 +2367,11 @@ wasm_application_execute_func(WASMModuleInstanceCommon *module_inst,
}
#endif

if (!type) {
LOG_ERROR("invalid module instance type");
return false;
}

if (type->param_count != (uint32)argc) {
wasm_runtime_set_exception(module_inst,
"invalid input argument count");
Expand Down
4 changes: 3 additions & 1 deletion core/iwasm/common/wasm_shared_memory.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,8 +200,10 @@ notify_wait_list(bh_list *wait_list, uint32 count)
notify_count = wait_list->len;

node = bh_list_first_elem(wait_list);
if (!node)
return 0;

for (i = 0; i < count; i++) {
for (i = 0; i < notify_count; i++) {
bh_assert(node);
next = bh_list_elem_next(node);

Expand Down
2 changes: 1 addition & 1 deletion core/iwasm/compilation/aot_compiler.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,11 +180,11 @@ typedef enum FloatArithmetic {
goto fail; \
} \
aot_value = wasm_runtime_malloc(sizeof(AOTValue)); \
memset(aot_value, 0, sizeof(AOTValue)); \
if (!aot_value) { \
aot_set_last_error("allocate memory failed."); \
goto fail; \
} \
memset(aot_value, 0, sizeof(AOTValue)); \
aot_value->type = value_type; \
aot_value->value = llvm_value; \
aot_value_stack_push \
Expand Down
Loading