ref: 55cf967bdf6f94d963080f57c34271ef0623f68f
parent: 7b2e145dea7203b40c179c78942d46a2b820d322
author: Martin Storsjö <[email protected]>
date: Wed May 13 18:08:04 EDT 2020
checkasm: arm64: Take the number of stack arguments into account when checking for stack clobbering
--- a/tests/checkasm/arm/checkasm_64.S
+++ b/tests/checkasm/arm/checkasm_64.S
@@ -121,13 +121,15 @@
ldp x16, x17, [x9], #32
ldp x8, x9, [x9]
- // For stack overflows, we want to check the values immediately
- // on the stack, which (may) come from arguments - so we can't
- // place custom values there. Instead just check them as-is
- // against a reference that is stored inverted (so that a stack
- // overflow that overwrites everything with the same value will
- // be noticed).
- ldr x2, [sp]
+ // For stack overflows, the callee is free to overwrite the parameters
+ // that were passed on the stack (if any), so we can only check after
+ // that point. First figure out how many parameters the function
+ // really took on the stack:
+ ldr w2, [x29, #16 + 8*8 + (MAX_ARGS-8)*8]
+ // Load the first non-parameter value from the stack, that should be
+ // left untouched by the function. Store a copy of it inverted, so that
+ // e.g. overwriting everything with zero would be noticed.
+ ldr x2, [sp, x2, lsl #3]
mvn x2, x2
str x2, [sp, #ARG_STACK-16]
@@ -140,8 +142,9 @@
// Call the target function
blr x12
- // Load the stack canary and its reference
- ldr x2, [sp]
+ // Load the number of stack parameters, stack canary and its reference
+ ldr w2, [x29, #16 + 8*8 + (MAX_ARGS-8)*8]
+ ldr x2, [sp, x2, lsl #3]
ldr x3, [sp, #ARG_STACK-16]
add sp, sp, #ARG_STACK
--- a/tests/checkasm/checkasm.h
+++ b/tests/checkasm/checkasm.h
@@ -235,7 +235,8 @@
void checkasm_stack_clobber(uint64_t clobber, ...);
#define declare_new(ret, ...)\
ret (*checked_call)(void *, int, int, int, int, int, int, int,\
- __VA_ARGS__) =\
+ __VA_ARGS__, int, int, int, int, int, int, int, int,\
+ int, int, int, int, int, int, int) =\
(void *)checkasm_checked_call;
#define CLOB (UINT64_C(0xdeadbeefdeadbeef))
#define call_new(...)\
@@ -244,7 +245,8 @@
CLOB, CLOB, CLOB, CLOB, CLOB, CLOB,\
CLOB, CLOB, CLOB, CLOB, CLOB, CLOB,\
CLOB, CLOB, CLOB, CLOB, CLOB),\
- checked_call(func_new, 0, 0, 0, 0, 0, 0, 0, __VA_ARGS__));\
+ checked_call(func_new, 0, 0, 0, 0, 0, 0, 0, __VA_ARGS__,\
+ 7, 6, 5, 4, 3, 2, 1, 0, 0, 0, 0, 0, 0, 0, 0));\
checkasm_set_signal_handler_state(0)
#else
#define declare_new(ret, ...)