Commit 96355f50 by Abseil Team Committed by Copybara-Service

absl: harden stack bounds check

Ensure that we know both real low and high stack bounds
when relying on the stack bounds check.

PiperOrigin-RevId: 504003431
Change-Id: I8f6e6b75f5edff233d3cf80285f81b53f9080a0f
parent 7e8d8018
......@@ -267,13 +267,21 @@ static void **NextStackFrame(void **old_fp, const void *uc,
// guessed frame pointers incorrectly and now risk a paging fault
// dereferencing a wrong frame pointer. Or maybe not because large frames
// are possible as well. The main stack is assumed to be readable,
// so we assume the large frame is legit if we know the stack bounds and are
// within the stack.
if (new_fp_u - old_fp_u > kMaxFrameBytes &&
(stack_high == kUnknownStackEnd ||
!(stack_low < new_fp_u && new_fp_u <= stack_high))) {
// so we assume the large frame is legit if we know the real stack bounds
// and are within the stack.
if (new_fp_u - old_fp_u > kMaxFrameBytes) {
if (stack_high < kUnknownStackEnd &&
static_cast<size_t>(getpagesize()) < stack_low) {
// Stack bounds are known.
if (!(stack_low < new_fp_u && new_fp_u <= stack_high)) {
// new_fp_u is not within the known stack.
return nullptr;
}
} else {
// Stack bounds are unknown, prefer truncated stack to possible crash.
return nullptr;
}
}
if (stack_low < old_fp_u && old_fp_u <= stack_high) {
// Old BP was in the expected stack region...
if (!(stack_low < new_fp_u && new_fp_u <= stack_high)) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment