1 /**
2 * Copyright (c) 2021-2022 Huawei Device Co., Ltd.
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 #include "cflow_check.h"
17 #include "cflow_common.h"
18 #include "cflow_iterate_inl.h"
19 #include "runtime/include/method-inl.h"
20 #include "utils/logger.h"
21 #include "verification/jobs/job.h"
22 #include "verification/util/str.h"
23 #include "verifier_messages.h"
24
25 #include <iomanip>
26 #include <optional>
27
28 namespace panda::verifier {
29
CheckCode(Method const * method,CflowMethodInfo const * cflowInfo)30 static VerificationStatus CheckCode(Method const *method, CflowMethodInfo const *cflowInfo)
31 {
32 uint8_t const *methodStart = method->GetInstructions();
33 uint8_t const *methodEnd =
34 methodStart + method->GetCodeSize(); // NOLINT(cppcoreguidelines-pro-bounds-pointer-arithmetic
35 auto handlerStarts = cflowInfo->GetHandlerStartAddresses();
36 size_t nandlerIndex = (*handlerStarts)[0] == methodStart ? 0 : -1;
37 return IterateOverInstructions(
38 methodStart, methodStart, methodEnd,
39 [&](auto type, uint8_t const *pc, size_t size, [[maybe_unused]] bool exceptionSource,
40 auto target) -> std::optional<VerificationStatus> {
41 if (target != nullptr) { // a jump
42 if (!cflowInfo->IsAddrValid(target)) {
43 LOG_VERIFIER_CFLOW_INVALID_JUMP_OUTSIDE_METHOD_BODY(
44 method->GetFullName(), OffsetAsHexStr(methodStart, target), OffsetAsHexStr(methodStart, pc));
45 return VerificationStatus::ERROR;
46 }
47 if (!cflowInfo->IsFlagSet(target, CflowMethodInfo::INSTRUCTION)) {
48 LOG_VERIFIER_CFLOW_INVALID_JUMP_INTO_MIDDLE_OF_INSTRUCTION(
49 method->GetFullName(), OffsetAsHexStr(methodStart, target), OffsetAsHexStr(methodStart, pc));
50 return VerificationStatus::ERROR;
51 }
52 if (cflowInfo->IsFlagSet(target, CflowMethodInfo::EXCEPTION_HANDLER)) {
53 if (!cflowInfo->IsFlagSet(pc, CflowMethodInfo::EXCEPTION_HANDLER)) {
54 // - jumps into body of exception handler from code is prohibited by Panda compiler.
55 LOG_VERIFIER_CFLOW_INVALID_JUMP_INTO_EXC_HANDLER(
56 method->GetFullName(), (OffsetAsHexStr(method->GetInstructions(), pc)));
57 return VerificationStatus::ERROR;
58 }
59 // Jump from handler to handler; need to make sure it's the same one.
60 if (target < (*handlerStarts)[nandlerIndex] || target >= (*handlerStarts)[nandlerIndex + 1]) {
61 LOG_VERIFIER_CFLOW_INVALID_JUMP_INTO_EXC_HANDLER(
62 method->GetFullName(), (OffsetAsHexStr(method->GetInstructions(), pc)));
63 return VerificationStatus::ERROR;
64 }
65 }
66 }
67 uint8_t const *nextInstPc = &pc[size]; // NOLINT(cppcoreguidelines-pro-bounds-pointer-arithmetic
68 if (nextInstPc == methodEnd) {
69 if (type != InstructionType::THROW && type != InstructionType::JUMP &&
70 type != InstructionType::RETURN) {
71 LOG_VERIFIER_CFLOW_INVALID_LAST_INSTRUCTION(method->GetFullName());
72 return VerificationStatus::ERROR;
73 }
74 return VerificationStatus::OK;
75 }
76 if (nextInstPc == (*handlerStarts)[nandlerIndex + 1]) {
77 if (type != InstructionType::JUMP && type != InstructionType::RETURN &&
78 type != InstructionType::THROW) {
79 // - fallthrough on beginning of exception handler is prohibited by Panda compiler
80 LOG_VERIFIER_CFLOW_BODY_FALL_INTO_EXC_HANDLER(method->GetFullName(),
81 (OffsetAsHexStr(method->GetInstructions(), pc)));
82 return VerificationStatus::ERROR;
83 }
84 nandlerIndex++;
85 }
86 return std::nullopt;
87 });
88 }
89
CheckCflow(Method const * method)90 PandaUniquePtr<CflowMethodInfo> CheckCflow(Method const *method)
91 {
92 auto cflowInfo = GetCflowMethodInfo(method);
93 if (!cflowInfo) {
94 return {};
95 }
96
97 if (CheckCode(method, cflowInfo.get()) == VerificationStatus::ERROR) {
98 return {};
99 }
100
101 return cflowInfo;
102 }
103
104 } // namespace panda::verifier
105