From dc47634ec45ca14a2ccdb3779dfa0cd83d199a78 Mon Sep 17 00:00:00 2001 From: Peter Collingbourne Date: Wed, 12 May 2021 15:56:43 -0700 Subject: Test that out-of-bounds UAF is not detected with MTE. This type of error is unlikely and attempting to detect it with MTE is likely to produce false positive reports. Make sure that this type of error is not detected by the allocator. Change-Id: I90676d1a031411d6b725890311317802bc24b459 --- debuggerd/debuggerd_test.cpp | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) (limited to 'debuggerd/debuggerd_test.cpp') diff --git a/debuggerd/debuggerd_test.cpp b/debuggerd/debuggerd_test.cpp index 144faeec0..193bf6b7c 100644 --- a/debuggerd/debuggerd_test.cpp +++ b/debuggerd/debuggerd_test.cpp @@ -512,6 +512,38 @@ TEST_P(SizeParamCrasherTest, mte_uaf) { #endif } +TEST_P(SizeParamCrasherTest, mte_oob_uaf) { +#if defined(__aarch64__) + if (!mte_supported()) { + GTEST_SKIP() << "Requires MTE"; + } + + int intercept_result; + unique_fd output_fd; + StartProcess([&]() { + SetTagCheckingLevelSync(); + volatile int* p = (volatile int*)malloc(GetParam()); + free((void *)p); + p[-1] = 42; + }); + + StartIntercept(&output_fd); + FinishCrasher(); + AssertDeath(SIGSEGV); + FinishIntercept(&intercept_result); + + ASSERT_EQ(1, intercept_result) << "tombstoned reported failure"; + + std::string result; + ConsumeFd(std::move(output_fd), &result); + + ASSERT_MATCH(result, R"(signal 11 \(SIGSEGV\))"); + ASSERT_NOT_MATCH(result, R"(Cause: \[MTE\]: Use After Free, 4 bytes left)"); +#else + GTEST_SKIP() << "Requires aarch64"; +#endif +} + TEST_P(SizeParamCrasherTest, mte_overflow) { #if defined(__aarch64__) if (!mte_supported()) { -- cgit v1.2.3