Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d6a45752 authored by Peter Collingbourne's avatar Peter Collingbourne Committed by Automerger Merge Worker
Browse files

Merge "Test that out-of-bounds UAF is not detected with MTE." am: fc7852b7... 

Merge "Test that out-of-bounds UAF is not detected with MTE." am: fc7852b7 am: 4e122e05 am: 8958c323

Original change: https://android-review.googlesource.com/c/platform/system/core/+/1705657

Change-Id: Ibaebbbded90dca299acc9e8e07ad532e0738b4c1
parents 3055d4b7 8958c323

debuggerd/debuggerd_test.cpp

+32 −0
Original line number Original line Diff line number Diff line
@@ -514,6 +514,38 @@ TEST_P(SizeParamCrasherTest, mte_uaf) { 
#endif

#endif

}

}





TEST_P(SizeParamCrasherTest, mte_oob_uaf) {

#if defined(__aarch64__)

  if (!mte_supported()) {

    GTEST_SKIP() << "Requires MTE";

  }



  int intercept_result;

  unique_fd output_fd;

  StartProcess([&]() {

    SetTagCheckingLevelSync();

    volatile int* p = (volatile int*)malloc(GetParam());

    free((void *)p);

    p[-1] = 42;

  });



  StartIntercept(&output_fd);

  FinishCrasher();

  AssertDeath(SIGSEGV);

  FinishIntercept(&intercept_result);



  ASSERT_EQ(1, intercept_result) << "tombstoned reported failure";



  std::string result;

  ConsumeFd(std::move(output_fd), &result);



  ASSERT_MATCH(result, R"(signal 11 \(SIGSEGV\))");

  ASSERT_NOT_MATCH(result, R"(Cause: \[MTE\]: Use After Free, 4 bytes left)");

#else

  GTEST_SKIP() << "Requires aarch64";

#endif

}



TEST_P(SizeParamCrasherTest, mte_overflow) {

TEST_P(SizeParamCrasherTest, mte_overflow) {

#if defined(__aarch64__)

#if defined(__aarch64__)

  if (!mte_supported()) {

  if (!mte_supported()) {