Advertisement
Guest User

Untitled

a guest
Feb 19th, 2017
78
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.06 KB | None | 0 0
  1. //src and dest are user controlled but must be valid.
  2. TrustedPart_for_safe_jit(mutext, uint8_t *src,uint8_t *dest, uint32_t size) // in the current case, *dest targets a PROT_NONE memory region
  3. {
  4. MutexLock(mutext);
  5. ValidateOpcodes(src,size); // uses calls to mmap on size internally. Contains many loops : this is the longest part.
  6. unwriteprotect(dest,size); // calls many sandbox’s internal functions
  7.  
  8. SafeMemcpy(src,dest,size); // THIS IS the function which contains the race condition
  9.  
  10. asm("mfence");
  11. unEXECprotect(dest,size); // involve write protecting as well as allowing reading
  12. MutexUnlock(mutext);
  13. }
  14.  
  15. SafeMemcpy(uint8_t *src,uint8_t *dest, uint32_t size) // the data to be copied cannot exceed 128Mb
  16. {
  17. if(!CheckUserTarget(dest,size) {
  18. uint8_t *src_ptr=src;
  19. uint8_t *dest_ptr=dest;
  20. uint8_t *end_ptr=des+size;
  21. while (dest_ptr < end_ptr) { // that loop should execute very fast
  22. *(uint32_t *) dest_ptr = *(uint32_t *) src_ptr;
  23. dest_ptr += 32;
  24. src_ptr += 32;
  25. }
  26. }
  27. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement