Changeset 97866 in vbox for trunk/src/VBox/Runtime/common

Timestamp:

Dec 26, 2022 2:14:08 AM (2 years ago)

Author:

vboxsync

Message:

IPRT/nocrt: Added an exception handler to rtVccEh4DoLocalUnwind and implemented rtVccValidateExceptionContextRecord. bugref:10261 ticketref:21303

Location:

trunk/src/VBox/Runtime/common/compiler/vcc

Files:

• except-x86-vcc-asm.asm (modified) (1 diff)
• except-x86-vcc.cpp (modified) (4 diffs)
• loadcfg-vcc.c (modified) (1 diff)
• stacksup-vcc.cpp (modified) (1 diff)

trunk/src/VBox/Runtime/common/compiler/vcc/except-x86-vcc-asm.asm

@@ -86 +86 @@
 BEGINCODE
 extern IMPNAME(RtlUnwind@16)
-
-
-
+extern _rtVccEh4DoLocalUnwindHandler@16
+
+
+;*********************************************************************************************************************************
+;*  Global Variables                                                                                                             *
+;*********************************************************************************************************************************
+
+;; Delcare rtVccEh4DoLocalUnwindHandler() in except-x86.cpp as a save exception handler.
+; This adds the symbol table number of the exception handler to the special .sxdata section.
+safeseh _rtVccEh4DoLocalUnwindHandler@16
+
+
+BEGINCODE
 ;;
 ; Calls the filter sub-function for a __finally statement.

trunk/src/VBox/Runtime/common/compiler/vcc/except-x86-vcc.cpp

@@ -39 +39 @@
 *   Header Files                                                                                                                 *
 *********************************************************************************************************************************/
-#include <iprt/win/windows.h>
-
+#include <iprt/nt/nt-and-windows.h>
+
+#include "internal/compiler-vcc.h"
 #include "except-vcc.h"
+
+
+/*********************************************************************************************************************************
+*   Structures and Typedefs                                                                                                      *
+*********************************************************************************************************************************/
+/**
+ * Extended exception registration record used by rtVccEh4DoLocalUnwind
+ * and rtVccEh4DoLocalUnwindHandler.
+ */
+typedef struct EH4_LOCAL_UNWIND_XCPT_REG
+{
+    /** Security cookie. */
+    uintptr_t                       uEHCookieFront;
+    /** The actual registration record.   */
+    EXCEPTION_REGISTRATION_RECORD   XcptRegRec;
+    /** @name rtVccEh4DoLocalUnwind parameters
+     * @{ */
+    PEH4_XCPT_REG_REC_T             pEh4XcptRegRec;
+    uint32_t                        uTargetTryLevel;
+    uint8_t const                  *pbFrame;
+    /** @} */
+    /** Security cookie. */
+    uintptr_t                       uEHCookieBack;
+} EH4_LOCAL_UNWIND_XCPT_REG;
+
 
 
@@ -57 +83 @@
 DECLASM(void)                   rtVccEh4DoGlobalUnwind(PEXCEPTION_RECORD pXcptRec, PEXCEPTION_REGISTRATION_RECORD pXcptRegRec);
 DECLASM(void)                   rtVccEh4DoFinally(PFN_EH4_FINALLY_T pfnFinally, bool fAbend, uint8_t const *pbFrame);
-
+extern "C" EXCEPTION_DISPOSITION __stdcall
+rtVccEh4DoLocalUnwindHandler(PEXCEPTION_RECORD pXcptRec, PVOID pvEstFrame, PCONTEXT pCpuCtx, PVOID pvDispCtx);
+
+
+#ifdef _MSC_VER
+# pragma warning(push)
+# pragma warning(disable:4733)  /* warning C4733: Inline asm assigning to 'FS:0': handler not registered as safe handler */
+#endif
 
 /**
@@ -72 +105 @@
      * Manually set up exception handler.
      */
-    /** @todo    */
+    EH4_LOCAL_UNWIND_XCPT_REG RegRec =
+    {
+        __security_cookie ^ (uintptr_t)&RegRec,
+        {
+            (EXCEPTION_REGISTRATION_RECORD *)__readfsdword(RT_UOFFSETOF(NT_TIB, ExceptionList)),
+            rtVccEh4DoLocalUnwindHandler /* safeseh (.sxdata) entry emitted by except-x86-vcc-asm.asm */
+        },
+        pEh4XcptRegRec,
+        uTargetTryLevel,
+        pbFrame,
+        __security_cookie ^ (uintptr_t)&RegRec
+    };
+    __writefsdword(RT_UOFFSETOF(NT_TIB, ExceptionList), (uintptr_t)&RegRec.XcptRegRec);
 
     /*
@@ -101 +146 @@
      * Deregister exception handler.
      */
-    /** @todo */
-}
-
-
+    __writefsdword(RT_UOFFSETOF(NT_TIB, ExceptionList), (uintptr_t)RegRec.XcptRegRec.Next);
+}
+
+#ifdef _MSC_VER
+# pragma warning(pop)
+#endif
+
+/**
+ * Exception handler for rtVccEh4DoLocalUnwind.
+ */
+EXCEPTION_DISPOSITION __stdcall
+rtVccEh4DoLocalUnwindHandler(PEXCEPTION_RECORD pXcptRec, PVOID pvEstFrame, PCONTEXT pCpuCtx, PVOID pvDispCtx)
+{
+    EH4_LOCAL_UNWIND_XCPT_REG *pMyRegRec = RT_FROM_MEMBER(pvEstFrame, EH4_LOCAL_UNWIND_XCPT_REG, XcptRegRec);
+    __security_check_cookie(pMyRegRec->uEHCookieFront ^ (uintptr_t)pMyRegRec);
+    __security_check_cookie(pMyRegRec->uEHCookieBack  ^ (uintptr_t)pMyRegRec);
+
+    /*
+     * This is a little sketchy as it isn't all that well documented by the OS
+     * vendor, but if invoked while unwinding, we return ExceptionCollidedUnwind
+     * and update the *ppDispCtx value to point to the colliding one.
+     */
+    if (pXcptRec->ExceptionFlags & (EXCEPTION_UNWINDING | EXCEPTION_EXIT_UNWIND))
+    {
+        rtVccEh4DoLocalUnwind(pMyRegRec->pEh4XcptRegRec, pMyRegRec->uTargetTryLevel, pMyRegRec->pbFrame);
+
+        PEXCEPTION_REGISTRATION_RECORD *ppDispCtx = (PEXCEPTION_REGISTRATION_RECORD *)pvDispCtx;
+        *ppDispCtx = &pMyRegRec->XcptRegRec;
+        return ExceptionCollidedUnwind;
+    }
+
+    /*
+     * In all other cases we do nothing special.
+     */
+    RT_NOREF(pCpuCtx);
+    return ExceptionContinueSearch;
+}
+
+
+/**
+ * This validates the CPU context, may terminate the application if invalid.
+ */
 DECLINLINE(void) rtVccValidateExceptionContextRecord(PCONTEXT pCpuCtx)
 {
-    RT_NOREF(pCpuCtx);
-    /** @todo  Implement __exception_validate_context_record .*/
+    if (RT_LIKELY(   !rtVccIsGuardICallChecksActive()
+                  || rtVccIsPointerOnTheStack(pCpuCtx->Esp)))
+    { /* likely */ }
+    else
+        rtVccCheckContextFailed(pCpuCtx);
 }
 

trunk/src/VBox/Runtime/common/compiler/vcc/loadcfg-vcc.c

@@ -56 +56 @@
 extern uint8_t      __safe_se_handler_count;    /**< Absolute "address" defined by the linker representing the table size. */
 #endif
-extern uintptr_t    __guard_check_icall_fptr;   /**< nocrt-guard-win.asm */
 #ifdef RT_ARCH_AMD64
 extern uintptr_t    __guard_dispatch_icall_fptr;/**< nocrt-guard-win.asm */

trunk/src/VBox/Runtime/common/compiler/vcc/stacksup-vcc.cpp

@@ -329 +329 @@
 }
 
+
+void rtVccCheckContextFailed(PCONTEXT pCpuCtx)
+{
+#ifdef IPRT_NOCRT_WITHOUT_FATAL_WRITE
+    RTAssertMsg2("\n\n!!Context (stack) check failed!!\n\n"
+                 "PC=%p SP=%p BP=%p\n",
+# ifdef RT_ARCH_AMD64
+                 pCpuCtx->Rip, pCpuCtx->Rsp, pCpuCtx->Rbp
+# elif defined(RT_ARCH_X86)
+                 pCpuCtx->Eip, pCpuCtx->Esp, pCpuCtx->Ebp
+# else
+#  error "unsupported arch"
+# endif
+                 );
+#else
+    rtNoCrtFatalWriteBegin(RT_STR_TUPLE("\r\n\r\n!!Context (stack) check failed!!\r\n\r\n"
+                                       "PC="));
+# ifdef RT_ARCH_AMD64
+    rtNoCrtFatalWritePtr((void *)pCpuCtx->Rip);
+# elif defined(RT_ARCH_X86)
+    rtNoCrtFatalWritePtr((void *)pCpuCtx->Eip);
+# else
+#  error "unsupported arch"
+# endif
+    rtNoCrtFatalWrite(RT_STR_TUPLE(" SP="));
+# ifdef RT_ARCH_AMD64
+    rtNoCrtFatalWritePtr((void *)pCpuCtx->Rsp);
+# elif defined(RT_ARCH_X86)
+    rtNoCrtFatalWritePtr((void *)pCpuCtx->Esp);
+# endif
+    rtNoCrtFatalWrite(RT_STR_TUPLE(" BP="));
+# ifdef RT_ARCH_AMD64
+    rtNoCrtFatalWritePtr((void *)pCpuCtx->Rbp);
+# elif defined(RT_ARCH_X86)
+    rtNoCrtFatalWritePtr((void *)pCpuCtx->Ebp);
+# endif
+    rtNoCrtFatalWriteEnd(RT_STR_TUPLE("\r\n"));
+#endif
+    rtVccFatalSecurityErrorWithCtx(FAST_FAIL_INVALID_SET_OF_CONTEXT, pCpuCtx);
+}
+