830_security.c File Reference

Unit test for security-hardening features of the infix library. More...

#include "common/double_tap.h"
#include "common/infix_internals.h"
#include <infix/infix.h>
#include <limits.h>
#include <stdlib.h>
#include <signal.h>
#include <sys/wait.h>
#include <unistd.h>

Include dependency graph for 830_security.c:

Macros
#define	DBLTAP_IMPLEMENTATION

Functions
int	dummy_target_func (int a)
void	dummy_handler_func (void)
	subtest ("Guard pages prevent use-after-free")
	subtest ("Writing to a hardened reverse trampoline context causes a crash")
	subtest ("API hardening against integer overflows")
	subtest ("POSIX hardened allocator (shm_open)")

Variables
	TEST

Detailed Description

Unit test for security-hardening features of the infix library.

This test file verifies several critical security mechanisms designed to make the library resilient against common memory corruption vulnerabilities. Since these tests involve intentionally triggering crashes, they are executed in child processes to avoid terminating the main test runner.

The test covers:

1. Use-After-Free (UAF) Prevention:
   • It creates a trampoline (forward bound, forward unbound, and reverse), destroys it, and then attempts to call the dangling function pointer.
   • It verifies that this action results in an immediate and controlled crash (e.g., a SIGSEGV), proving that the "guard page" mechanism in infix_executable_free is working correctly.
2. Context Memory Hardening:
   • It creates a reverse trampoline, whose context struct is allocated in a special memory region.
   • After creation, the JIT engine makes this memory region read-only.
   • The test then attempts to write to a field within this context (rt->user_data).
   • It verifies that this write attempt causes a crash, proving that the context is successfully protected from runtime memory corruption.
3. API Hardening against Integer Overflows:
   • It calls infix_type_create_* functions with maliciously crafted inputs designed to cause integer overflows during size and layout calculations (e.g., creating an array with SIZE_MAX elements).
   • It verifies that the API functions detect these overflows, return an error status (INFIX_ERROR_INVALID_ARGUMENT), and do not proceed with a potentially dangerous allocation.

Macro Definition Documentation

DBLTAP_IMPLEMENTATION

#define DBLTAP_IMPLEMENTATION

Function Documentation

dummy_handler_func()

void dummy_handler_func

(

void

)

dummy_target_func()

int dummy_target_func

(

int

a

)

subtest() [1/4]

subtest

(

"API hardening against integer overflows"

)

subtest() [2/4]

subtest

(

"Guard pages prevent use-after-free"

)

subtest() [3/4]

subtest

(

"POSIX hardened allocator (shm_open)"

)

subtest() [4/4]

subtest

(

"Writing to a hardened reverse trampoline context causes a crash"

)

Variable Documentation

TEST

TEST