1 /**
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 #include <stdlib.h>
17 #include "../includes/common.h"
18
19 //This PoC is only for 32-bit builds
20 #if _32_BIT
21 #include <unistd.h>
22 #include <string.h>
23 #include <dlfcn.h>
24
25 #define MAX_STRLEN 256
26 #define LOOP_COUNT 10
27 #define LIB_NAME "/system/lib/libandroid.so"
28
runDlopenDlcloseLibraryLoop(char * libName,unsigned char count)29 int runDlopenDlcloseLibraryLoop(char *libName, unsigned char count) {
30 while (count) {
31 void *lib_handle = dlopen(libName, RTLD_NOW);
32 if (!lib_handle) {
33 return EXIT_FAILURE;
34 }
35 if (dlclose(lib_handle)) {
36 return EXIT_FAILURE;
37 }
38 count--;
39 }
40 return EXIT_SUCCESS;
41 }
getMemoryUsage(unsigned long * memUsage)42 int getMemoryUsage(unsigned long *memUsage) {
43 char cmd[MAX_STRLEN];
44 char buf[MAX_STRLEN];
45 memset(cmd, 0, MAX_STRLEN);
46 memset(buf, 0, MAX_STRLEN);
47 sprintf(cmd, "cat /proc/%d/maps | grep anon:linker_alloc]", getpid());
48 FILE *fpMem = popen(cmd, "r");
49 if (!fpMem) {
50 return EXIT_FAILURE;
51 }
52 unsigned long totalMemUsage = 0;
53 while (fgets(buf, MAX_STRLEN, fpMem) != NULL) {
54 unsigned long mem1 = 0;
55 unsigned long mem2 = 0;
56 int numOfItemsRead = sscanf(buf, "%lx-%lx", &mem1, &mem2);
57 if (numOfItemsRead < 2) {
58 pclose(fpMem);
59 return EXIT_FAILURE;
60 }
61 totalMemUsage += mem2 - mem1;
62 }
63 pclose(fpMem);
64 *memUsage = totalMemUsage;
65 return EXIT_SUCCESS;
66 }
67 #endif /* _32_BIT */
68
main()69 int main() {
70
71 //This PoC is only for 32-bit builds
72 #if _32_BIT
73 /* Memory usage is expected to rise during first few dlopen-dlcose pairs */
74 /* due to linker initializations. Hence memory is not tracked during */
75 /* first few dlopen-dlcose pairs. */
76 if (runDlopenDlcloseLibraryLoop(LIB_NAME, LOOP_COUNT)) {
77 return EXIT_FAILURE;
78 }
79
80 /* The linker specific initializations should be complete. Hence Memory */
81 /* usage is tracked from this point onwards. Further dlopen-dlcose pairs */
82 /* are not expected to increase memory usage */
83 unsigned long memUsageBefore = 0;
84 if (getMemoryUsage(&memUsageBefore)) {
85 return EXIT_FAILURE;
86 }
87
88 if (runDlopenDlcloseLibraryLoop(LIB_NAME, LOOP_COUNT)) {
89 return EXIT_FAILURE;
90 }
91
92 unsigned long memUsageAfter = 0;
93 if (getMemoryUsage(&memUsageAfter)) {
94 return EXIT_FAILURE;
95 }
96
97 if (memUsageBefore != memUsageAfter) {
98 return EXIT_VULNERABLE;
99 }
100 #endif /* _32_BIT */
101
102 return EXIT_SUCCESS;
103 }
104