Skip to content

Commit 32bada2

Browse files
committed
[lsan] Fix stack buffer overwrite in SuspendedThreadsListMac::GetRegistersAndSP
The call to the thread_get_state syscall (that fetches the register values for a thread) on arm64 is mistakenly claiming that the buffer to receive the register state is larger that its actual size on the stack -- the struct on the stack is arm_thread_state64_t, but the MACHINE_THREAD_STATE + MACHINE_THREAD_STATE_COUNT refer to the "unified arm state" struct (which is larger). Fixes #58503. Differential Revision: https://reviews.llvm.org/D137292
1 parent 5b0c217 commit 32bada2

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

Diff for: compiler-rt/lib/sanitizer_common/sanitizer_stoptheworld_mac.cpp

+5-2
Original file line numberDiff line numberDiff line change
@@ -87,11 +87,13 @@ void StopTheWorld(StopTheWorldCallback callback, void *argument) {
8787

8888
#if defined(__x86_64__)
8989
typedef x86_thread_state64_t regs_struct;
90+
#define regs_flavor x86_THREAD_STATE64
9091

9192
#define SP_REG __rsp
9293

9394
#elif defined(__aarch64__)
9495
typedef arm_thread_state64_t regs_struct;
96+
#define regs_flavor ARM_THREAD_STATE64
9597

9698
# if __DARWIN_UNIX03
9799
# define SP_REG __sp
@@ -101,6 +103,7 @@ typedef arm_thread_state64_t regs_struct;
101103

102104
#elif defined(__i386)
103105
typedef x86_thread_state32_t regs_struct;
106+
#define regs_flavor x86_THREAD_STATE32
104107

105108
#define SP_REG __esp
106109

@@ -146,8 +149,8 @@ PtraceRegistersStatus SuspendedThreadsListMac::GetRegistersAndSP(
146149
thread_t thread = GetThread(index);
147150
regs_struct regs;
148151
int err;
149-
mach_msg_type_number_t reg_count = MACHINE_THREAD_STATE_COUNT;
150-
err = thread_get_state(thread, MACHINE_THREAD_STATE, (thread_state_t)&regs,
152+
mach_msg_type_number_t reg_count = sizeof(regs) / sizeof(natural_t);
153+
err = thread_get_state(thread, regs_flavor, (thread_state_t)&regs,
151154
&reg_count);
152155
if (err != KERN_SUCCESS) {
153156
VReport(1, "Error - unable to get registers for a thread\n");

0 commit comments

Comments
 (0)