gnh1201/wasm-micro-runtime
1
0
Fork 0
mirror of https://github.com/bytecodealliance/wasm-micro-runtime.git synced 2025-03-12 00:45:28 +00:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

Enhance security of libc strcpy/sprintf wrapper function (#108)

Browse Source
This commit is contained in:
wenyongh 2019-08-29 14:31:15 +08:00 committed by GitHub
parent 5257dd8a48
commit 4a14e54e86
1 changed files with 16 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
core/iwasm/lib/native/libc/libc_wrapper.c
View File

@ -473,13 +473,17 @@ static int
_sprintf_wrapper(int32 str_offset, int32 fmt_offset, int32 va_list_offset) _sprintf_wrapper(int32 str_offset, int32 fmt_offset, int32 va_list_offset)
{ {
wasm_module_inst_t module_inst = get_module_inst(); wasm_module_inst_t module_inst = get_module_inst();
int32 app_end_offset;
struct str_context ctx; struct str_context ctx;
char *str; char *str;
const char *fmt; const char *fmt;
_va_list va_args; _va_list va_args;
if (!validate_str_addr(module_inst, str_offset)) if (!wasm_runtime_get_app_addr_range(module_inst, str_offset,
return 0; NULL, &app_end_offset)) {
wasm_runtime_set_exception(module_inst, "out of bounds memory access");
return false;
}
str = addr_app_to_native(str_offset); str = addr_app_to_native(str_offset);
@ -487,7 +491,7 @@ _sprintf_wrapper(int32 str_offset, int32 fmt_offset, int32 va_list_offset)
return 0; return 0;
ctx.str = str; ctx.str = str;
ctx.max = INT_MAX; ctx.max = app_end_offset - str_offset;
ctx.count = 0; ctx.count = 0;
if (!_vprintf_wa((out_func_t)sprintf_out, &ctx, fmt, va_args, module_inst)) if (!_vprintf_wa((out_func_t)sprintf_out, &ctx, fmt, va_args, module_inst))
@ -692,17 +696,19 @@ _strcpy_wrapper(int32 dst_offset, int32 src_offset)
{ {
wasm_module_inst_t module_inst = get_module_inst(); wasm_module_inst_t module_inst = get_module_inst();
char *dst, *src; char *dst, *src;
uint32 len;
if (!validate_str_addr(module_inst, dst_offset) if (!validate_str_addr(module_inst, src_offset))
|| !validate_str_addr(module_inst, src_offset)) return 0;
src = addr_app_to_native(src_offset);
len = strlen(src);
if (!validate_app_addr(dst_offset, len + 1))
return 0; return 0;
dst = addr_app_to_native(dst_offset); dst = addr_app_to_native(dst_offset);
src = addr_app_to_native(src_offset); strncpy(dst, src, len + 1);
while (*src != '\0')
*dst++ = *src++;
*dst = '\0';
return dst_offset; return dst_offset;
} }