277fdd1de7
This CL renames a number of things related to the V8 sandbox. Mainly, what used to be under V8_HEAP_SANDBOX is now under V8_SANDBOXED_EXTERNAL_POINTERS, while the previous V8 VirtualMemoryCage is now simply the V8 Sandbox: V8_VIRTUAL_MEMORY_CAGE => V8_SANDBOX V8_HEAP_SANDBOX => V8_SANDBOXED_EXTERNAL_POINTERS V8_CAGED_POINTERS => V8_SANDBOXED_POINTERS V8VirtualMemoryCage => Sandbox CagedPointer => SandboxedPointer fake cage => partially reserved sandbox src/security => src/sandbox This naming scheme should simplify things: the sandbox is now the large region of virtual address space inside which V8 mainly operates and which should be considered untrusted. Mechanisms like sandboxed pointers are then used to attempt to prevent escapes from the sandbox (i.e. corruption of memory outside of it). Furthermore, the new naming scheme avoids the confusion with the various other "cages" in V8, in particular, the VirtualMemoryCage class, by dropping that name entirely. Future sandbox features are developed under their own V8_SANDBOX_X flag, and will, once final, be merged into V8_SANDBOX. Current future features are sandboxed external pointers (using the external pointer table), and sandboxed pointers (pointers guaranteed to point into the sandbox, e.g. because they are encoded as offsets). This CL then also introduces a new build flag, v8_enable_sandbox_future, which enables all future features. Bug: v8:10391 Change-Id: I5174ea8f5ab40fb96a04af10853da735ad775c96 Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3322981 Reviewed-by: Hannes Payer <hpayer@chromium.org> Reviewed-by: Igor Sheludko <ishell@chromium.org> Reviewed-by: Michael Achenbach <machenbach@chromium.org> Reviewed-by: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Samuel Groß <saelo@chromium.org> Cr-Commit-Position: refs/heads/main@{#78384}
117 lines
3.4 KiB
C++
117 lines
3.4 KiB
C++
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#include "test/fuzzer/fuzzer-support.h"
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
|
|
#include "include/libplatform/libplatform.h"
|
|
#include "include/v8-context.h"
|
|
#include "include/v8-initialization.h"
|
|
#include "src/flags/flags.h"
|
|
#include "src/trap-handler/trap-handler.h"
|
|
|
|
namespace v8_fuzzer {
|
|
|
|
FuzzerSupport::FuzzerSupport(int* argc, char*** argv) {
|
|
v8::internal::FLAG_expose_gc = true;
|
|
v8::V8::SetFlagsFromCommandLine(argc, *argv, true);
|
|
v8::V8::InitializeICUDefaultLocation((*argv)[0]);
|
|
v8::V8::InitializeExternalStartupData((*argv)[0]);
|
|
platform_ = v8::platform::NewDefaultPlatform();
|
|
v8::V8::InitializePlatform(platform_.get());
|
|
#ifdef V8_SANDBOX
|
|
if (!v8::V8::InitializeSandbox()) {
|
|
FATAL("Could not initialize the sandbox");
|
|
}
|
|
#endif
|
|
v8::V8::Initialize();
|
|
|
|
allocator_ = v8::ArrayBuffer::Allocator::NewDefaultAllocator();
|
|
v8::Isolate::CreateParams create_params;
|
|
create_params.array_buffer_allocator = allocator_;
|
|
create_params.allow_atomics_wait = false;
|
|
isolate_ = v8::Isolate::New(create_params);
|
|
|
|
{
|
|
v8::Isolate::Scope isolate_scope(isolate_);
|
|
v8::HandleScope handle_scope(isolate_);
|
|
context_.Reset(isolate_, v8::Context::New(isolate_));
|
|
}
|
|
}
|
|
|
|
FuzzerSupport::~FuzzerSupport() {
|
|
{
|
|
v8::Isolate::Scope isolate_scope(isolate_);
|
|
while (PumpMessageLoop()) {
|
|
// empty
|
|
}
|
|
|
|
v8::HandleScope handle_scope(isolate_);
|
|
context_.Reset();
|
|
}
|
|
|
|
isolate_->LowMemoryNotification();
|
|
isolate_->Dispose();
|
|
isolate_ = nullptr;
|
|
|
|
delete allocator_;
|
|
allocator_ = nullptr;
|
|
|
|
v8::V8::Dispose();
|
|
v8::V8::DisposePlatform();
|
|
}
|
|
|
|
std::unique_ptr<FuzzerSupport> FuzzerSupport::fuzzer_support_;
|
|
|
|
// static
|
|
void FuzzerSupport::InitializeFuzzerSupport(int* argc, char*** argv) {
|
|
#if V8_ENABLE_WEBASSEMBLY
|
|
if (V8_TRAP_HANDLER_SUPPORTED) {
|
|
constexpr bool kUseDefaultTrapHandler = true;
|
|
if (!v8::V8::EnableWebAssemblyTrapHandler(kUseDefaultTrapHandler)) {
|
|
FATAL("Could not register trap handler");
|
|
}
|
|
}
|
|
#endif // V8_ENABLE_WEBASSEMBLY
|
|
DCHECK_NULL(FuzzerSupport::fuzzer_support_);
|
|
FuzzerSupport::fuzzer_support_ =
|
|
std::make_unique<v8_fuzzer::FuzzerSupport>(argc, argv);
|
|
}
|
|
|
|
// static
|
|
FuzzerSupport* FuzzerSupport::Get() {
|
|
DCHECK_NOT_NULL(FuzzerSupport::fuzzer_support_);
|
|
return FuzzerSupport::fuzzer_support_.get();
|
|
}
|
|
|
|
v8::Local<v8::Context> FuzzerSupport::GetContext() {
|
|
v8::Isolate::Scope isolate_scope(isolate_);
|
|
v8::EscapableHandleScope handle_scope(isolate_);
|
|
v8::Local<v8::Context> context =
|
|
v8::Local<v8::Context>::New(isolate_, context_);
|
|
return handle_scope.Escape(context);
|
|
}
|
|
|
|
bool FuzzerSupport::PumpMessageLoop(
|
|
v8::platform::MessageLoopBehavior behavior) {
|
|
return v8::platform::PumpMessageLoop(platform_.get(), isolate_, behavior);
|
|
}
|
|
|
|
} // namespace v8_fuzzer
|
|
|
|
// Explicitly specify some attributes to avoid issues with the linker dead-
|
|
// stripping the following function on macOS, as it is not called directly
|
|
// by fuzz target. LibFuzzer runtime uses dlsym() to resolve that function.
|
|
#if V8_OS_MACOSX
|
|
__attribute__((used)) __attribute__((visibility("default")))
|
|
#endif // V8_OS_MACOSX
|
|
extern "C" int
|
|
LLVMFuzzerInitialize(int* argc, char*** argv) {
|
|
v8_fuzzer::FuzzerSupport::InitializeFuzzerSupport(argc, argv);
|
|
return 0;
|
|
}
|