From 281cd47c154e7cd642e76482f5f07e9f1584c561 Mon Sep 17 00:00:00 2001
From: realmadsci <71108352+realmadsci@users.noreply.github.com>
Date: Fri, 12 Mar 2021 14:46:49 -0500
Subject: libqasan: Add checks for read() and write()

---
 qemu_mode/libqasan/hooks.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'qemu_mode/libqasan')

diff --git a/qemu_mode/libqasan/hooks.c b/qemu_mode/libqasan/hooks.c
index 9c406c74..0e6c3e08 100644
--- a/qemu_mode/libqasan/hooks.c
+++ b/qemu_mode/libqasan/hooks.c
@@ -51,6 +51,7 @@ ssize_t write(int fd, const void *buf, size_t count) {
   void *rtv = __builtin_return_address(0);
 
   QASAN_DEBUG("%14p: write(%d, %p, %zu)\n", rtv, fd, buf, count);
+  QASAN_LOAD(buf, count);
   ssize_t r = __lq_libc_write(fd, buf, count);
   QASAN_DEBUG("\t\t = %zd\n", r);
 
@@ -63,6 +64,7 @@ ssize_t read(int fd, void *buf, size_t count) {
   void *rtv = __builtin_return_address(0);
 
   QASAN_DEBUG("%14p: read(%d, %p, %zu)\n", rtv, fd, buf, count);
+  QASAN_STORE(buf, count);
   ssize_t r = __lq_libc_read(fd, buf, count);
   QASAN_DEBUG("\t\t = %zd\n", r);
 
-- 
cgit 1.4.1


From 96574854b34b42650190648014c7ca673cfd31ce Mon Sep 17 00:00:00 2001
From: realmadsci <71108352+realmadsci@users.noreply.github.com>
Date: Thu, 4 Mar 2021 13:33:06 -0500
Subject: libqasan/malloc: Additional pointer checks

Add checks to free() and malloc_usable_size() to
verify (sort of) that the pointers are actually
pointing at valid allocated memory before dereferencing
them and using the chunk_begin struct info.

This will catch use-after-free and wildly bad pointers
a little bit earlier.
---
 qemu_mode/libqasan/malloc.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'qemu_mode/libqasan')

diff --git a/qemu_mode/libqasan/malloc.c b/qemu_mode/libqasan/malloc.c
index 5a2d2a0c..6fe6fc8c 100644
--- a/qemu_mode/libqasan/malloc.c
+++ b/qemu_mode/libqasan/malloc.c
@@ -159,6 +159,9 @@ size_t __libqasan_malloc_usable_size(void *ptr) {
   char *p = ptr;
   p -= sizeof(struct chunk_begin);
 
+  // Validate that the chunk marker is readable (a crude check
+  // to verify that ptr is a valid malloc region before we dereference it)
+  QASAN_LOAD(p, sizeof(struct chunk_begin) - REDZONE_SIZE);
   return ((struct chunk_begin *)p)->requested_size;
 
 }
@@ -225,6 +228,9 @@ void __libqasan_free(void *ptr) {
   struct chunk_begin *p = ptr;
   p -= 1;
 
+  // Validate that the chunk marker is readable (a crude check
+  // to verify that ptr is a valid malloc region before we dereference it)
+  QASAN_LOAD(p, sizeof(struct chunk_begin) - REDZONE_SIZE);
   size_t n = p->requested_size;
 
   QASAN_STORE(ptr, n);
-- 
cgit 1.4.1