Skip to content

Add basic canary check to BSSL stack thunk #6156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 28, 2019
Merged

Add basic canary check to BSSL stack thunk #6156

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion cores/esp8266/StackThunk.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ uint32_t *stack_thunk_top = NULL;
uint32_t *stack_thunk_save = NULL; /* Saved A1 while in BearSSL */
uint32_t stack_thunk_refcnt = 0;

#define _stackSize (5750/4)
#define _stackSize (5748/4)
#define _stackPaint 0xdeadbeef

/* Add a reference, and allocate the stack if necessary */
Expand Down Expand Up @@ -124,4 +124,11 @@ void stack_thunk_dump_stack()
ets_printf("<<<stack<<<\n");
}

/* Called when the stack overflow is detected by a thunk. Main memory is corrupted at this point. Do not return. */
void stack_thunk_fatal_overflow()
{
ets_printf("FATAL ERROR: BSSL stack overflow\n");
abort();
}

};
10 changes: 10 additions & 0 deletions cores/esp8266/StackThunk.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ extern uint32_t stack_thunk_get_stack_bot();
extern uint32_t stack_thunk_get_cont_sp();
extern uint32_t stack_thunk_get_max_usage();
extern void stack_thunk_dump_stack();
extern void stack_thunk_fatal_overflow();

// Globals required for thunking operation
extern uint32_t *stack_thunk_ptr;
Expand All @@ -53,6 +54,7 @@ extern uint32_t stack_thunk_refcnt;
__asm("\n\
.text\n\
.literal_position\n\
.literal .LC_STACK_VALUE"#fcnToThunk", 0xdeadbeef\n\
\n\
.text\n\
.global thunk_"#fcnToThunk"\n\
Expand All @@ -67,6 +69,14 @@ thunk_"#fcnToThunk":\n\
movi a15, stack_thunk_top /* Load A1(SP) with thunk stack */\n\
l32i.n a1, a15, 0\n\
call0 "#fcnToThunk" /* Do the call */\n\
/* Check the stack canary wasn't overwritten */\n\
movi a15, stack_thunk_ptr\n\
l32i.n a15, a15, 0 /* A15 now has the pointer to stack end*/ \n\
l32i.n a15, a15, 0 /* A15 now has contents of last stack entry */\n\
l32r a0, .LC_STACK_VALUE"#fcnToThunk" /* A0 now has the check value */\n\
beq a0, a15, .L1"#fcnToThunk"\n\
call0 stack_thunk_fatal_overflow\n\
.L1"#fcnToThunk":\n\
movi a15, stack_thunk_save /* Restore A1(SP) */\n\
l32i.n a1, a15, 0\n\
l32i.n a15, a1, 8 /* Restore the saved registers */\n\
Expand Down