diff options
author | Corinna Vinschen <corinna@vinschen.de> | 2012-02-27 15:55:27 +0400 |
---|---|---|
committer | Corinna Vinschen <corinna@vinschen.de> | 2012-02-27 15:55:27 +0400 |
commit | 07a6b9dd22954bdabd2f468cd5657bca6cf5db2a (patch) | |
tree | f6553bea39de38a6b332df10a90198f2daa51a2b /winsup/cygwin/cygtls.cc | |
parent | d723fb604d729b0d1b4cadea5abb9d2ef160a47b (diff) |
* cygtls.cc (dll_cmp): New comparison function for bsearch.
(well_known_dlls): New array containing well-known DLLs.
(_cygtls::call2): Add code for BLODA detection.
* net.cc (fdsock): Ditto.
Diffstat (limited to 'winsup/cygwin/cygtls.cc')
-rw-r--r-- | winsup/cygwin/cygtls.cc | 61 |
1 files changed, 60 insertions, 1 deletions
diff --git a/winsup/cygwin/cygtls.cc b/winsup/cygwin/cygtls.cc index f45cfaa52..7b9c2a827 100644 --- a/winsup/cygwin/cygtls.cc +++ b/winsup/cygwin/cygtls.cc @@ -1,6 +1,7 @@ /* cygtls.cc - Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Red Hat, Inc. + Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, + 2012 Red Hat, Inc. This software is a copyrighted work licensed under the terms of the Cygwin license. Please consult the file "CYGWIN_LICENSE" for @@ -62,10 +63,68 @@ _cygtls::call (DWORD (*func) (void *, void *), void *arg) _my_tls.call2 (func, arg, buf); } +static int +dll_cmp (const void *a, const void *b) +{ + return wcscasecmp ((const wchar_t *) a, *(const wchar_t **) b); +} + +/* Keep sorted! + This is a list of well-known core system DLLs which contain code + whiuch is started in its own thread by the system. Kernel32.dll, + for instance, contains the thread called on every Ctrl-C keypress + in a console window. The DLLs in this list are not recognized as + BLODAs. */ +const wchar_t *well_known_dlls[] = +{ + L"kernel32.dll", + L"mswsock.dll", + L"ntdll.dll", + L"ws2_32.dll", +}; + void _cygtls::call2 (DWORD (*func) (void *, void *), void *arg, void *buf) { init_thread (buf, func); + + /* Optional BLODA detection. The idea is that the function address is + supposed to be within Cygwin itself. This is also true for pthreads, + since pthreads are always calling thread_wrapper in miscfuncs.cc. + Therefore, every function call to a function outside of the Cygwin DLL + is potentially a thread injected into the Cygwin process by some BLODA. + + But that's a bit too simple. Assuming the application itself calls + CreateThread, then this is a bad idea, but not really invalid. So we + shouldn't print a BLODA message if the address is within the loaded + image of the application. Also, ntdll.dll starts threads into the + application which */ + if (detect_bloda) + { + PIMAGE_DOS_HEADER img_start = (PIMAGE_DOS_HEADER) GetModuleHandle (NULL); + PIMAGE_NT_HEADERS32 ntheader = (PIMAGE_NT_HEADERS32) + ((PBYTE) img_start + img_start->e_lfanew); + void *img_end = (void *) ((PBYTE) img_start + + ntheader->OptionalHeader.SizeOfImage); + if (((void *) func < (void *) cygwin_hmodule + || (void *) func > (void *) cygheap) + && ((void *) func < (void *) img_start || (void *) func >= img_end)) + { + MEMORY_BASIC_INFORMATION mbi; + wchar_t modname[PATH_MAX]; + + VirtualQuery ((PVOID) func, &mbi, sizeof mbi); + GetModuleFileNameW ((HMODULE) mbi.AllocationBase, modname, PATH_MAX); + /* Fetch basename and check against list of above system DLLs. */ + const wchar_t *modbasename = wcsrchr (modname, L'\\') + 1; + if (!bsearch (modbasename, well_known_dlls, + sizeof well_known_dlls / sizeof well_known_dlls[0], + sizeof well_known_dlls[0], dll_cmp)) + small_printf ("\n\nPotential BLODA detected! Thread function " + "called outside of Cygwin DLL:\n %W\n\n", modname); + } + } + DWORD res = func (arg, buf); remove (INFINITE); /* Don't call ExitThread on the main thread since we may have been |