| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
| |
BUG=242304
R=jln@chromium.org
TBR=jln@chromium.org
Review URL: https://chromiumcodereview.appspot.com/15766009
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@202760 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
| |
BUG=175554
R=jln@chromium.org
Review URL: https://codereview.chromium.org/15108007
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@200543 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Re-enable the check for calloc() overflow on ASAN now that it is
fixed.
BUG=175554
NOTRY=true
Review URL: https://chromiumcodereview.appspot.com/13077004
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@192354 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Let NewOverflow compile on Windows for the most part
- Strengthen the compiler barrier on GCC compatible compilers
This is a re-land of https://codereview.chromium.org/13460015/ with the
Windows test kept disabled for now.
BUG=174947
NOTRY=true
TBR=jschuh
Review URL: https://chromiumcodereview.appspot.com/13600003
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@192310 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
> Base Security: fix-up overflow tests
>
> - Re-enable NewOverflow on Windows for the most part
> - Strengthen the compiler barrier on GCC compatible compilers
>
> BUG=174947
>
>
> Review URL: https://chromiumcodereview.appspot.com/13460015
http://build.chromium.org/p/chromium.win/builders/Win7%20Tests%20%28dbg%29%281%29/builds/17219/steps/base_unittests/logs/NewOverflow
TBR=jln@chromium.org
Review URL: https://codereview.chromium.org/13529002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@192040 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
| |
- Re-enable NewOverflow on Windows for the most part
- Strengthen the compiler barrier on GCC compatible compilers
BUG=174947
Review URL: https://chromiumcodereview.appspot.com/13460015
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@192031 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
allocators return NULL in the case of an overflow.
BUG=175554,172149
TBR=mark
Review URL: https://chromiumcodereview.appspot.com/13061002
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@190437 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
On Linux, when not using tcmalloc, we still have a small wrapper
that aborts when allocation functions OOM.
In that configuration, we now We consider it a successful detection
of an overflow condition if the process aborts.
BUG=175500
Review URL: https://chromiumcodereview.appspot.com/12220107
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@182628 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
It doesn't even compile for 64-bit under MSVC.
BUG=174947
TBR=jln@chromium.org, jar@chromium.org
R=jln, jar
Review URL: https://codereview.chromium.org/12223042
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@181361 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add more compiler barriers to prevent the compiler from optimizing
out calls to the very function we're testing.
This makes SecurityTest* pass in a Clang release build.
BUG=174452
NOTRY=true
Review URL: https://chromiumcodereview.appspot.com/12210023
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180888 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We loosen ASLR by only growing one random mapping. The previous version
had security benefits but had a negative performance impact.
This change aims to be performance neutral in respect to the pre-ASLR era.
At a later date, we may try to strike a good balance between performance and
security.
This is a re-land of https://chromiumcodereview.appspot.com/12090112/
BUG=170133, 173371
NOTRY=true
TBR=jar
Review URL: https://chromiumcodereview.appspot.com/12192024
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180556 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
> Linux: grow a unique random mapping in ASLR
>
> We loosen ASLR by only growing one random mapping. The previous version
> had security benefits but had a negative performance impact.
> This change aims to be performance neutral in respect to the pre-ASLR era.
> At a later date, we may try to strike a good balance between performance and
> security.
>
> This is a re-land of https://chromiumcodereview.appspot.com/12090112/
>
> BUG=170133, 173371
> NOTRY=true
> TBR=jar
>
>
> Review URL: https://chromiumcodereview.appspot.com/12185028
TBR=jln@chromium.org
Review URL: https://codereview.chromium.org/12192022
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180522 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We loosen ASLR by only growing one random mapping. The previous version
had security benefits but had a negative performance impact.
This change aims to be performance neutral in respect to the pre-ASLR era.
At a later date, we may try to strike a good balance between performance and
security.
This is a re-land of https://chromiumcodereview.appspot.com/12090112/
BUG=170133, 173371
NOTRY=true
TBR=jar
Review URL: https://chromiumcodereview.appspot.com/12185028
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180514 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
> Linux: grow a unique random mapping in ASLR
>
> We loosen ASLR by only growing one random mapping. The previous version
> had security benefits but had a negative performance impact.
> This change aims to be performance neutral in respect to the pre-ASLR era.
> At a later date, we may try to strike a good balance between performance and
> security.
>
> BUG=170133,173371
> NOTRY=true
>
> Review URL: https://chromiumcodereview.appspot.com/12090112
TBR=jln@chromium.org
Review URL: https://codereview.chromium.org/12186021
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180491 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We loosen ASLR by only growing one random mapping. The previous version
had security benefits but had a negative performance impact.
This change aims to be performance neutral in respect to the pre-ASLR era.
At a later date, we may try to strike a good balance between performance and
security.
BUG=170133,173371
NOTRY=true
Review URL: https://chromiumcodereview.appspot.com/12090112
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@180486 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
On Linux and Chrome OS, we implement user-land ASLR in TCMalloc
on 64 bits Intel architecture.
In this configuration, we are not constrained by the address space
and we don't mind fragmentation.
But to be on the safe side, we only ever fragment half of the
address space.
BUG=170133
NOTRY=true
Review URL: https://chromiumcodereview.appspot.com/12093035
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@179776 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
overflowing.
This is a re-land of https://chromiumcodereview.appspot.com/12033064/.
BUG=172149
NOTRY=true
TBR=jar
Review URL: https://chromiumcodereview.appspot.com/12087012
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@179040 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
> Base: add a security test to check for new[] or calloc()
> overflowing
>
> BUG=172149
> NOTRY=true
>
> Review URL: https://chromiumcodereview.appspot.com/12033064
Reverted due to failing base_unittests (speculative revert).
TBR=jln@chromium.org
Review URL: https://codereview.chromium.org/12086009
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@178972 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
|
| |
overflowing
BUG=172149
NOTRY=true
Review URL: https://chromiumcodereview.appspot.com/12033064
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@178928 0039d316-1c4b-4281-b951-d872f2087c98
|
|
|
|
|
|
|
|
|
|
| |
BUG=109874
R=darin@chromium.org,ajwong@chromium.org
Review URL: https://chromiumcodereview.appspot.com/11961021
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@177670 0039d316-1c4b-4281-b951-d872f2087c98
|
|
For security purposes, we restrict the maximum size of memory allocations under
what can be indexed by an int.
BUG=169327
NOTRY=true
Review URL: https://chromiumcodereview.appspot.com/11857007
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@176961 0039d316-1c4b-4281-b951-d872f2087c98
|