1 /**
2 * Copyright (c) 2021-2024 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "cflow_check.h"
17 #include "cflow_common.h"
18 #include "cflow_iterate_inl.h"
19 #include "runtime/include/method-inl.h"
20 #include "utils/logger.h"
21 #include "verification/jobs/job.h"
22 #include "verification/util/str.h"
23 #include "verifier_messages.h"
24
25 #include <iomanip>
26 #include <optional>
27
28 namespace ark::verifier {
29
CheckValidFlagInstructionException(Method const * & method,CflowMethodInfo const * & cflowInfo,const uint8_t * & target,uint8_t const * & methodStart,uint8_t const * & pc)30 static VerificationStatus CheckValidFlagInstructionException(Method const *&method, CflowMethodInfo const *&cflowInfo,
31 const uint8_t *&target, uint8_t const *&methodStart,
32 uint8_t const *&pc)
33 {
34 if (!cflowInfo->IsAddrValid(target)) {
35 LOG_VERIFIER_CFLOW_INVALID_JUMP_OUTSIDE_METHOD_BODY(method->GetFullName(), OffsetAsHexStr(methodStart, target),
36 OffsetAsHexStr(methodStart, pc));
37 return VerificationStatus::ERROR;
38 }
39 if (!cflowInfo->IsFlagSet(target, CflowMethodInfo::INSTRUCTION)) {
40 LOG_VERIFIER_CFLOW_INVALID_JUMP_INTO_MIDDLE_OF_INSTRUCTION(
41 method->GetFullName(), OffsetAsHexStr(methodStart, target), OffsetAsHexStr(methodStart, pc));
42 return VerificationStatus::ERROR;
43 }
44 if (cflowInfo->IsFlagSet(target, CflowMethodInfo::EXCEPTION_HANDLER) &&
45 !cflowInfo->IsFlagSet(pc, CflowMethodInfo::EXCEPTION_HANDLER)) {
46 // - jumps into body of exception handler from code is prohibited by Panda compiler.
47 LOG_VERIFIER_CFLOW_INVALID_JUMP_INTO_EXC_HANDLER(method->GetFullName(),
48 (OffsetAsHexStr(method->GetInstructions(), pc)));
49 return VerificationStatus::ERROR;
50 }
51
52 return VerificationStatus::OK;
53 }
54
CheckCode(Method const * method,CflowMethodInfo const * cflowInfo)55 static VerificationStatus CheckCode(Method const *method, CflowMethodInfo const *cflowInfo)
56 {
57 uint8_t const *methodStart = method->GetInstructions();
58 // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic
59 uint8_t const *methodEnd = methodStart + method->GetCodeSize();
60 auto handlerStarts = cflowInfo->GetHandlerStartAddresses();
61 size_t nandlerIndex = (*handlerStarts)[0] == methodStart ? 0 : -1;
62 return IterateOverInstructions(
63 methodStart, methodStart, methodEnd,
64 [&](auto type, uint8_t const *pc, size_t size, [[maybe_unused]] bool exceptionSource,
65 auto target) -> std::optional<VerificationStatus> {
66 if (target != nullptr) { // a jump
67 if (CheckValidFlagInstructionException(method, cflowInfo, target, methodStart, pc) ==
68 VerificationStatus::ERROR) {
69 return VerificationStatus::ERROR;
70 }
71
72 if (cflowInfo->IsFlagSet(target, CflowMethodInfo::EXCEPTION_HANDLER) &&
73 (target < (*handlerStarts)[nandlerIndex] || target >= (*handlerStarts)[nandlerIndex + 1])) {
74 // Jump from handler to handler; need to make sure it's the same one.
75 LOG_VERIFIER_CFLOW_INVALID_JUMP_INTO_EXC_HANDLER(method->GetFullName(),
76 (OffsetAsHexStr(method->GetInstructions(), pc)));
77 return VerificationStatus::ERROR;
78 }
79 }
80 // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic)
81 if (&pc[size] == methodEnd) {
82 if (type != InstructionType::THROW && type != InstructionType::JUMP &&
83 type != InstructionType::RETURN) {
84 LOG_VERIFIER_CFLOW_INVALID_LAST_INSTRUCTION(method->GetFullName());
85 return VerificationStatus::ERROR;
86 }
87 return VerificationStatus::OK;
88 }
89 // NOLINTNEXTLINE(cppcoreguidelines-pro-bounds-pointer-arithmetic)
90 if (&pc[size] == (*handlerStarts)[nandlerIndex + 1]) {
91 if (type != InstructionType::JUMP && type != InstructionType::RETURN &&
92 type != InstructionType::THROW) {
93 // - fallthrough on beginning of exception handler is prohibited by Panda compiler
94 LOG_VERIFIER_CFLOW_BODY_FALL_INTO_EXC_HANDLER(method->GetFullName(),
95 (OffsetAsHexStr(method->GetInstructions(), pc)));
96 return VerificationStatus::ERROR;
97 }
98 nandlerIndex++;
99 }
100 return std::nullopt;
101 });
102 }
103
CheckCflow(Method const * method)104 PandaUniquePtr<CflowMethodInfo> CheckCflow(Method const *method)
105 {
106 auto cflowInfo = GetCflowMethodInfo(method);
107 if (!cflowInfo) {
108 return {};
109 }
110
111 if (CheckCode(method, cflowInfo.get()) == VerificationStatus::ERROR) {
112 return {};
113 }
114
115 return cflowInfo;
116 }
117
118 } // namespace ark::verifier
119