Add simple exploitability analysis for Linux crashes.

https://breakpad.appspot.com/622002/



git-svn-id: http://google-breakpad.googlecode.com/svn/trunk@1226 4c0a9323-5329-0410-9bdc-e9ce6186880e

Makefile.am

@@ -155,6 +155,8 @@ src_libbreakpad_a_SOURCES = \
 	src/processor/disassembler_x86.h \
 	src/processor/disassembler_x86.cc \
 	src/processor/exploitability.cc \
+	src/processor/exploitability_linux.h \
+	src/processor/exploitability_linux.cc \
 	src/processor/exploitability_win.h \
 	src/processor/exploitability_win.cc \
 	src/processor/fast_source_line_resolver_types.h \
@@ -623,6 +625,7 @@ src_processor_exploitability_unittest_LDADD = \
 	src/processor/process_state.o \
 	src/processor/disassembler_x86.o \
 	src/processor/exploitability.o \
+	src/processor/exploitability_linux.o \
 	src/processor/exploitability_win.o \
 	src/processor/basic_code_modules.o \
 	src/processor/basic_source_line_resolver.o \
@@ -631,6 +634,7 @@ src_processor_exploitability_unittest_LDADD = \
 	src/processor/logging.o \
 	src/processor/minidump.o \
 	src/processor/pathname_stripper.o \
+	src/processor/simple_symbol_supplier.o \
 	src/processor/source_line_resolver_base.o \
 	src/processor/stack_frame_symbolizer.o \
 	src/processor/stackwalker.o \
@@ -716,6 +720,7 @@ src_processor_minidump_processor_unittest_LDADD = \
 	src/processor/cfi_frame_info.o \
 	src/processor/disassembler_x86.o \
 	src/processor/exploitability.o \
+	src/processor/exploitability_linux.o \
 	src/processor/exploitability_win.o \
 	src/processor/logging.o \
 	src/processor/minidump_processor.o \
@@ -845,6 +850,7 @@ src_processor_stackwalker_selftest_LDADD = \
 	src/processor/call_stack.o \
 	src/processor/disassembler_x86.o \
 	src/processor/exploitability.o \
+	src/processor/exploitability_linux.o \
 	src/processor/exploitability_win.o \
 	src/processor/logging.o \
 	src/processor/minidump.o \
@@ -997,6 +1003,7 @@ src_processor_minidump_stackwalk_LDADD = \
 	src/processor/cfi_frame_info.o \
 	src/processor/disassembler_x86.o \
 	src/processor/exploitability.o \
+	src/processor/exploitability_linux.o \
 	src/processor/exploitability_win.o \
 	src/processor/logging.o \
 	src/processor/minidump.o \

Makefile.in

@@ -288,6 +288,8 @@ am__src_libbreakpad_a_SOURCES_DIST =  \
 	src/processor/disassembler_x86.h \
 	src/processor/disassembler_x86.cc \
 	src/processor/exploitability.cc \
+	src/processor/exploitability_linux.h \
+	src/processor/exploitability_linux.cc \
 	src/processor/exploitability_win.h \
 	src/processor/exploitability_win.cc \
 	src/processor/fast_source_line_resolver_types.h \
@@ -348,6 +350,7 @@ am__src_libbreakpad_a_SOURCES_DIST =  \
 @DISABLE_PROCESSOR_FALSE@	src/processor/cfi_frame_info.$(OBJEXT) \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.$(OBJEXT) \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.$(OBJEXT) \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.$(OBJEXT) \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.$(OBJEXT) \
 @DISABLE_PROCESSOR_FALSE@	src/processor/fast_source_line_resolver.$(OBJEXT) \
 @DISABLE_PROCESSOR_FALSE@	src/processor/logging.$(OBJEXT) \
@@ -726,6 +729,7 @@ src_processor_exploitability_unittest_OBJECTS =  \
 @DISABLE_PROCESSOR_FALSE@	src/processor/process_state.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/basic_code_modules.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/basic_source_line_resolver.o \
@@ -734,6 +738,7 @@ src_processor_exploitability_unittest_OBJECTS =  \
 @DISABLE_PROCESSOR_FALSE@	src/processor/logging.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/minidump.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/pathname_stripper.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/simple_symbol_supplier.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/source_line_resolver_base.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/stack_frame_symbolizer.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/stackwalker.o \
@@ -808,6 +813,7 @@ src_processor_minidump_processor_unittest_OBJECTS =  \
 @DISABLE_PROCESSOR_FALSE@	src/processor/cfi_frame_info.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/logging.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/minidump_processor.o \
@@ -842,6 +848,7 @@ src_processor_minidump_stackwalk_OBJECTS =  \
 @DISABLE_PROCESSOR_FALSE@	src/processor/cfi_frame_info.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/logging.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/minidump.o \
@@ -992,6 +999,7 @@ src_processor_stackwalker_selftest_OBJECTS =  \
 @DISABLE_PROCESSOR_FALSE@	src/processor/call_stack.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/logging.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/minidump.o \
@@ -1482,6 +1490,8 @@ lib_LIBRARIES = $(am__append_5) $(am__append_7)
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.h \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.cc \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.cc \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.h \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.cc \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.h \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.cc \
 @DISABLE_PROCESSOR_FALSE@	src/processor/fast_source_line_resolver_types.h \
@@ -1860,6 +1870,7 @@ TESTS = $(check_PROGRAMS) $(check_SCRIPTS)
 @DISABLE_PROCESSOR_FALSE@	src/processor/process_state.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/basic_code_modules.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/basic_source_line_resolver.o \
@@ -1868,6 +1879,7 @@ TESTS = $(check_PROGRAMS) $(check_SCRIPTS)
 @DISABLE_PROCESSOR_FALSE@	src/processor/logging.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/minidump.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/pathname_stripper.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/simple_symbol_supplier.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/source_line_resolver_base.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/stack_frame_symbolizer.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/stackwalker.o \
@@ -1961,6 +1973,7 @@ TESTS = $(check_PROGRAMS) $(check_SCRIPTS)
 @DISABLE_PROCESSOR_FALSE@	src/processor/cfi_frame_info.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/logging.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/minidump_processor.o \
@@ -2104,6 +2117,7 @@ TESTS = $(check_PROGRAMS) $(check_SCRIPTS)
 @DISABLE_PROCESSOR_FALSE@	src/processor/call_stack.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/logging.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/minidump.o \
@@ -2267,6 +2281,7 @@ TESTS = $(check_PROGRAMS) $(check_SCRIPTS)
 @DISABLE_PROCESSOR_FALSE@	src/processor/cfi_frame_info.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/disassembler_x86.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability.o \
+@DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_linux.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/exploitability_win.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/logging.o \
 @DISABLE_PROCESSOR_FALSE@	src/processor/minidump.o \
@@ -2641,6 +2656,9 @@ src/processor/disassembler_x86.$(OBJEXT):  \
 	src/processor/$(DEPDIR)/$(am__dirstamp)
 src/processor/exploitability.$(OBJEXT): src/processor/$(am__dirstamp) \
 	src/processor/$(DEPDIR)/$(am__dirstamp)
+src/processor/exploitability_linux.$(OBJEXT):  \
+	src/processor/$(am__dirstamp) \
+	src/processor/$(DEPDIR)/$(am__dirstamp)
 src/processor/exploitability_win.$(OBJEXT):  \
 	src/processor/$(am__dirstamp) \
 	src/processor/$(DEPDIR)/$(am__dirstamp)
@@ -3628,6 +3646,7 @@ mostlyclean-compile:
 	-rm -f src/processor/contained_range_map_unittest.$(OBJEXT)
 	-rm -f src/processor/disassembler_x86.$(OBJEXT)
 	-rm -f src/processor/exploitability.$(OBJEXT)
+	-rm -f src/processor/exploitability_linux.$(OBJEXT)
 	-rm -f src/processor/exploitability_win.$(OBJEXT)
 	-rm -f src/processor/fast_source_line_resolver.$(OBJEXT)
 	-rm -f src/processor/logging.$(OBJEXT)
@@ -3877,6 +3896,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/contained_range_map_unittest.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/disassembler_x86.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/exploitability.Po@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/exploitability_linux.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/exploitability_win.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/fast_source_line_resolver.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@src/processor/$(DEPDIR)/logging.Po@am__quote@

src/google_breakpad/processor/process_state.h

@@ -50,39 +50,41 @@ class CallStack;
 class CodeModules;
 
 enum ExploitabilityRating {
-  EXPLOITABILITY_HIGH,                    // The crash likely represents
-                                          // a exploitable memory corruption
-                                          // vulnerability.
+  EXPLOITABILITY_HIGH,                 // The crash likely represents
+                                       // a exploitable memory corruption
+                                       // vulnerability.
 
-  EXPLOITABLITY_MEDIUM,                   // The crash appears to corrupt
-                                          // memory in a way which may be
-                                          // exploitable in some situations.
+  EXPLOITABILITY_MEDIUM,               // The crash appears to corrupt
+                                       // memory in a way which may be
+                                       // exploitable in some situations.
 
-  EXPLOITABILITY_LOW,                     // The crash either does not corrupt
-                                          // memory directly or control over
-                                          // the effected data is limited. The
-                                          // issue may still be exploitable
-                                          // on certain platforms or situations.
+  EXPLOITABLITY_MEDIUM = EXPLOITABILITY_MEDIUM,  // an old misspelling
 
-  EXPLOITABILITY_INTERESTING,             // The crash does not appear to be
-                                          // directly exploitable. However it
-                                          // represents a condition which should
-                                          // be furthur analyzed.
+  EXPLOITABILITY_LOW,                  // The crash either does not corrupt
+                                       // memory directly or control over
+                                       // the affected data is limited. The
+                                       // issue may still be exploitable
+                                       // on certain platforms or situations.
 
-  EXPLOITABILITY_NONE,                    // The crash does not appear to represent
-                                          // an exploitable condition.
+  EXPLOITABILITY_INTERESTING,          // The crash does not appear to be
+                                       // directly exploitable. However it
+                                       // represents a condition which should
+                                       // be further analyzed.
 
-  EXPLOITABILITY_NOT_ANALYZED,            // The crash was not analyzed for
-                                          // exploitability because the engine
-                                          // was disabled.
+  EXPLOITABILITY_NONE,                 // The crash does not appear to represent
+                                       // an exploitable condition.
 
-  EXPLOITABILITY_ERR_NOENGINE,            // The supplied minidump's platform does
-                                          // not have a exploitability engine
-                                          // associated with it.
+  EXPLOITABILITY_NOT_ANALYZED,         // The crash was not analyzed for
+                                       // exploitability because the engine
+                                       // was disabled.
 
-  EXPLOITABILITY_ERR_PROCESSING           // An error occured within the
-                                          // exploitability engine and no rating
-                                          // was calculated.
+  EXPLOITABILITY_ERR_NOENGINE,         // The supplied minidump's platform does
+                                       // not have a exploitability engine
+                                       // associated with it.
+
+  EXPLOITABILITY_ERR_PROCESSING        // An error occured within the
+                                       // exploitability engine and no rating
+                                       // was calculated.
 };
 
 class ProcessState {

src/processor/exploitability.cc

@@ -40,6 +40,7 @@
 #include "google_breakpad/processor/exploitability.h"
 #include "google_breakpad/processor/minidump.h"
 #include "google_breakpad/processor/process_state.h"
+#include "processor/exploitability_linux.h"
 #include "processor/exploitability_win.h"
 #include "processor/logging.h"
 
@@ -70,13 +71,15 @@ Exploitability *Exploitability::ExploitabilityForPlatform(
   switch (raw_system_info->platform_id) {
     case MD_OS_WIN32_NT:
     case MD_OS_WIN32_WINDOWS: {
-      platform_exploitability = new ExploitabilityWin(dump,
-                                                      process_state);
+      platform_exploitability = new ExploitabilityWin(dump, process_state);
+      break;
+    }
+    case MD_OS_LINUX: {
+      platform_exploitability = new ExploitabilityLinux(dump, process_state);
       break;
     }
     case MD_OS_MAC_OS_X:
     case MD_OS_IOS:
-    case MD_OS_LINUX:
     case MD_OS_UNIX:
     case MD_OS_SOLARIS:
     case MD_OS_ANDROID:

src/processor/exploitability_linux.cc

@@ -0,0 +1,86 @@
+// Copyright (c) 2013 Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// exploitability_linux.cc: Linux specific exploitability engine.
+//
+// Provides a guess at the exploitability of the crash for the Linux
+// platform given a minidump and process_state.
+//
+// Author: Matthew Riley
+
+#include "processor/exploitability_linux.h"
+
+#include "google_breakpad/processor/process_state.h"
+#include "google_breakpad/processor/call_stack.h"
+#include "google_breakpad/processor/stack_frame.h"
+
+namespace {
+
+// This function in libc is called if the program was compiled with
+// -fstack-protector and a function's stack canary changes.
+const char kStackCheckFailureFunction[] = "__stack_chk_fail";
+
+// This function in libc is called if the program was compiled with
+// -D_FORTIFY_SOURCE=2, a function like strcpy() is called, and the runtime
+// can determine that the call would overflow the target buffer.
+const char kBoundsCheckFailureFunction[] = "__chk_fail";
+
+}  // namespace
+
+namespace google_breakpad {
+
+ExploitabilityLinux::ExploitabilityLinux(Minidump *dump,
+                                         ProcessState *process_state)
+    : Exploitability(dump, process_state) { }
+
+ExploitabilityRating ExploitabilityLinux::CheckPlatformExploitability() {
+  // Check the crashing thread for functions suggesting a buffer overflow or
+  // stack smash.
+  if (process_state_->requesting_thread() != -1) {
+    CallStack* crashing_thread =
+        process_state_->threads()->at(process_state_->requesting_thread());
+    const vector<StackFrame*>& crashing_thread_frames =
+        *crashing_thread->frames();
+    for (size_t i = 0; i < crashing_thread_frames.size(); ++i) {
+      if (crashing_thread_frames[i]->function_name ==
+          kStackCheckFailureFunction) {
+        return EXPLOITABILITY_HIGH;
+      }
+
+      if (crashing_thread_frames[i]->function_name ==
+          kBoundsCheckFailureFunction) {
+        return EXPLOITABILITY_HIGH;
+      }
+    }
+  }
+
+  return EXPLOITABILITY_NONE;
+}
+
+}  // namespace google_breakpad

src/processor/exploitability_linux.h

@@ -0,0 +1,55 @@
+// Copyright (c) 2013 Google Inc.
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// exploitability_linux.h: Linux specific exploitability engine.
+//
+// Provides a guess at the exploitability of the crash for the Linux
+// platform given a minidump and process_state.
+//
+// Author: Matthew Riley
+
+#ifndef GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_
+#define GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_
+
+#include "google_breakpad/common/breakpad_types.h"
+#include "google_breakpad/processor/exploitability.h"
+
+namespace google_breakpad {
+
+class ExploitabilityLinux : public Exploitability {
+ public:
+  ExploitabilityLinux(Minidump *dump,
+                      ProcessState *process_state);
+
+  virtual ExploitabilityRating CheckPlatformExploitability();
+};
+
+}  // namespace google_breakpad
+
+#endif  // GOOGLE_BREAKPAD_PROCESSOR_EXPLOITABILITY_LINUX_H_

src/processor/exploitability_unittest.cc

@@ -35,213 +35,83 @@
 #include "breakpad_googletest_includes.h"
 #include "common/using_std_string.h"
 #include "google_breakpad/processor/basic_source_line_resolver.h"
-#include "google_breakpad/processor/call_stack.h"
-#include "google_breakpad/processor/code_module.h"
-#include "google_breakpad/processor/code_modules.h"
-#include "google_breakpad/processor/minidump.h"
 #include "google_breakpad/processor/minidump_processor.h"
 #include "google_breakpad/processor/process_state.h"
-#include "google_breakpad/processor/stack_frame.h"
-#include "google_breakpad/processor/symbol_supplier.h"
-
-namespace google_breakpad {
-class MockMinidump : public Minidump {
- public:
-  MockMinidump() : Minidump("") {
-  }
-
-  MOCK_METHOD0(Read, bool());
-  MOCK_CONST_METHOD0(path, string());
-  MOCK_CONST_METHOD0(header, const MDRawHeader*());
-  MOCK_METHOD0(GetThreadList, MinidumpThreadList*());
-};
-}
+#include "processor/simple_symbol_supplier.h"
 
 namespace {
 
 using google_breakpad::BasicSourceLineResolver;
-using google_breakpad::CallStack;
-using google_breakpad::CodeModule;
 using google_breakpad::MinidumpProcessor;
-using google_breakpad::MinidumpThreadList;
-using google_breakpad::MinidumpThread;
-using google_breakpad::MockMinidump;
 using google_breakpad::ProcessState;
-using google_breakpad::SymbolSupplier;
-using google_breakpad::SystemInfo;
+using google_breakpad::SimpleSymbolSupplier;
 
-class TestSymbolSupplier : public SymbolSupplier {
- public:
-  TestSymbolSupplier() : interrupt_(false) {}
-
-  virtual SymbolResult GetSymbolFile(const CodeModule *module,
-                                     const SystemInfo *system_info,
-                                     string *symbol_file);
-
-  virtual SymbolResult GetSymbolFile(const CodeModule *module,
-                                     const SystemInfo *system_info,
-                                     string *symbol_file,
-                                     string *symbol_data);
-
-  virtual SymbolResult GetCStringSymbolData(const CodeModule *module,
-                                            const SystemInfo *system_info,
-                                            string *symbol_file,
-                                            char **symbol_data,
-                                            size_t *symbol_data_size);
-
-  virtual void FreeSymbolData(const CodeModule *module) { }
-  // When set to true, causes the SymbolSupplier to return INTERRUPT
-  void set_interrupt(bool interrupt) { interrupt_ = interrupt; }
-
- private:
-  bool interrupt_;
-};
-
-SymbolSupplier::SymbolResult TestSymbolSupplier::GetSymbolFile(
-    const CodeModule *module,
-    const SystemInfo *system_info,
-    string *symbol_file) {
-
-  if (interrupt_) {
-    return INTERRUPT;
-  }
-
-  return NOT_FOUND;
+string TestDataDir() {
+  return string(getenv("srcdir") ? getenv("srcdir") : ".") +
+      "/src/processor/testdata";
 }
 
-SymbolSupplier::SymbolResult TestSymbolSupplier::GetCStringSymbolData(
-    const CodeModule *module,
-    const SystemInfo *system_info,
-    string *symbol_file,
-    char **symbol_data,
-    size_t *symbol_data_size) {
-  return GetSymbolFile(module, system_info, symbol_file);
-}
-
-SymbolSupplier::SymbolResult TestSymbolSupplier::GetSymbolFile(
-    const CodeModule *module,
-    const SystemInfo *system_info,
-    string *symbol_file,
-    string *symbol_data) {
-  return GetSymbolFile(module, system_info, symbol_file);
-}
-
-TEST(ExploitabilityTest, TestWindowsEngine) {
-  TestSymbolSupplier supplier;
+// Find the given dump file in <srcdir>/src/processor/testdata, process it,
+// and get the exploitability rating. Returns EXPLOITABILITY_ERR_PROCESSING
+// if the crash dump can't be processed.
+google_breakpad::ExploitabilityRating
+ExploitabilityFor(const string& filename) {
+  SimpleSymbolSupplier supplier(TestDataDir() + "/symbols");
   BasicSourceLineResolver resolver;
   MinidumpProcessor processor(&supplier, &resolver, true);
   ProcessState state;
 
-  string minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
-  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
+  string minidump_file = TestDataDir() + "/" + filename;
 
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_block_write.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
-  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
+  if (processor.Process(minidump_file, &state) !=
+      google_breakpad::PROCESS_OK) {
+    return google_breakpad::EXPLOITABILITY_ERR_PROCESSING;
+  }
 
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_clobber_write.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
-  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
+  return state.exploitability();
+}
 
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_conditional.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+TEST(ExploitabilityTest, TestWindowsEngine) {
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_then_jmp.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_read_av_xchg_write.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av_block_write.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_write_av.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av_clobber_write.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/ascii_write_av_arg_to_call.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av_conditional.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/null_read_av.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("ascii_read_av_then_jmp.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("ascii_read_av_xchg_write.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("ascii_write_av.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("ascii_write_av_arg_to_call.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/null_write_av.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("null_read_av.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/stack_exhaustion.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("null_write_av.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/exec_av_on_stack.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("stack_exhaustion.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/write_av_non_null.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
-  ASSERT_EQ(google_breakpad::EXPLOITABLITY_MEDIUM,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/read_av_non_null.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("exec_av_on_stack.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_MEDIUM,
+            ExploitabilityFor("write_av_non_null.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_LOW,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/read_av_clobber_write.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("read_av_non_null.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_LOW,
-            state.exploitability());
-
-  minidump_file = string(getenv("srcdir") ? getenv("srcdir") : ".") +
-      "/src/processor/testdata/read_av_conditional.dmp";
-  ASSERT_EQ(processor.Process(minidump_file, &state),
-            google_breakpad::PROCESS_OK);
+            ExploitabilityFor("read_av_clobber_write.dmp"));
   ASSERT_EQ(google_breakpad::EXPLOITABILITY_LOW,
-            state.exploitability());
+            ExploitabilityFor("read_av_conditional.dmp"));
+}
+
+TEST(ExploitabilityTest, TestLinuxEngine) {
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_NONE,
+            ExploitabilityFor("linux_null_read_av.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("linux_overflow.dmp"));
+  ASSERT_EQ(google_breakpad::EXPLOITABILITY_HIGH,
+            ExploitabilityFor("linux_stacksmash.dmp"));
 }
 }