On 05/31/2016 02:07 PM, Florian Weimer wrote:
I have implemented a completely different approach to vtable hardening.
The basic idea is to put all libc vtables into a single array, and then
check whether the vtable pointer is within that array.
Instead of a single array, how about instead putting all the vtables in
the same section with __attribute__ section. Something like:
+ #define __vtable __attribute__ ((section("vtables")))
- const struct _IO_jump_t _IO_file_jumps_mmap =
+ const struct _IO_jump_t __vtable _IO_file_jumps_mmap =
...
and then check whether the vtable pointer is within that section,
with __start_vtables, __end_vtables:
static inline const struct _IO_jump_t *
IO_validate_vtable (const struct _IO_jump_t *vtable)
{
extern char __start_vtables[];
extern char __end_vtables[];
if (!__glibc_likely ((long) __start_vtables <= vtable
&& vtable < (long) __end_vtables))
IO_vtable_check ();
return vtable;
}
That'd avoid having to have a central place that knows about all
the vtables. It'd probably make the patch smaller too, as
side effect.