/*+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Copyright (c) 1996-2000 Microsoft Corporation Module Name : attack.c Abstract : This file contains the ndr correlation check for denial of attacks. Author : Ryszard K. Kott (ryszardk) Sep 1997 Revision History : ---------------------------------------------------------------------*/ #include "ndrp.h" #include "hndl.h" #include "ndrole.h" #include "attack.h" #include "interp.h" #include "interp2.h" #include "mulsyntx.h" #include "asyncu.h" extern "C" { extern const GUID CLSID_RpcHelper; } inline PFORMAT_STRING GetConformanceDescriptor( PFORMAT_STRING pFormat ) { static uchar ConformanceDescIncrements[] = { 4, // Conformant array. 4, // Conformant varying array. 0, 0, // Fixed arrays - unused. 0, 0, // Varying arrays - unused. 4, // Complex array. 2, // Conformant char string. 2, // Conformant byte string. 4, // Conformant stringable struct. 2, // Conformant wide char string. 0, 0, 0, 0, // Non-conformant strings - unused. 0, // Encapsulated union - unused. 2, // Non-encapsulated union. 2, // Byte count pointer. 0, 0, // Xmit/Rep as - unused. 2 // Interface pointer. }; ASSERT( FC_CARRAY <= *pFormat && *pFormat < FC_END); return pFormat + ConformanceDescIncrements[ *pFormat - FC_CARRAY ]; } inline PFORMAT_STRING GetVarianceDescriptor( PFORMAT_STRING pFormat ) { // The array gives offset according to the size of the new correlation descriptors. static uchar VarianceDescIncrements[] = { 8 + NDR_CORR_EXTENSION_SIZE, // Conformant varying array. 0, 0, // Fixed arrays - unsed. 8, 12, // Varying array. 8 + NDR_CORR_EXTENSION_SIZE, // Complex array. }; ASSERT( FC_CVARRAY <= *pFormat && *pFormat <= FC_BOGUS_ARRAY ); return pFormat + VarianceDescIncrements[ *pFormat - FC_CVARRAY ]; } void NdrpCheckCorrelation( PMIDL_STUB_MESSAGE pStubMsg, LONG_PTR Value, PFORMAT_STRING pFormat, int CheckKind ) /* Checks if a correlation check can be performed or needs postponing. For early correlations it performs the check. For late correlations it adds an entry in the late correlatrion data base. Parameters Value - conformant value related to the descriptor pFormat - array, string etc object with the descriptor pStubMsg->pCorrMemory - current memory context like struct */ { // pStubMsg->pCorrelationInfo->pCorrFstr - descriptor for the current object // ASSERT( pStubMsg->pCorrInfo ); // TBD performance: index through 2 dim table could be faster. if ( ( CheckKind & ~NDR_RESET_VALUE ) == NDR_CHECK_CONFORMANCE ) pFormat = GetConformanceDescriptor( pFormat ); else pFormat = GetVarianceDescriptor( pFormat ); // See if we can actually check it out or whether we have to postpone it // till the correlation pass. NDR_FCDEF_CORRELATION * pConf = (NDR_FCDEF_CORRELATION *)pFormat; if ( pConf->CorrFlags.DontCheck ) return; unsigned char * pMemory = pStubMsg->pCorrMemory; if ( pConf->CorrFlags.Early ) { ULONG_PTR MaxCountSave = pStubMsg->MaxCount; ulong OffsetSave = pStubMsg->Offset; pStubMsg->Offset = 0; // this call overwrites pStubMsg->MaxCount NdrpValidateCorrelatedValue( pStubMsg, pMemory, pFormat, Value, CheckKind ); pStubMsg->MaxCount = MaxCountSave; pStubMsg->Offset = OffsetSave; } else { // Create correlation data base entry for the correlation pass. NdrpAddCorrelationData( pStubMsg, pMemory, pFormat, Value, CheckKind ); } } // void NdrpValidateCorrelatedValue ( PMIDL_STUB_MESSAGE pStubMsg, uchar * pMemory, PFORMAT_STRING pFormat, LONG_PTR Value, int CheckKind ) /*++ Routine Description : This routine computes the conformant size for an array or the switch_is value for a union. Arguments : pStubMsg - Pointer to the stub message. pMemory - Pointer to the embedding entity: a struct or a stack top. pFormat - Format string description of the correlation (at old). It indicates the correlated argument value. Value - value from the array etc, i.e. from the buffer, to be checked against Return : The array or string size or the union switch_is. --*/ { void * pCount = 0; LONG_PTR Count; unsigned char FormatCopy[4]; BOOL fAsyncSplit = FALSE; BOOL fResetValue; fResetValue = CheckKind & NDR_RESET_VALUE; CheckKind = CheckKind & ~NDR_RESET_VALUE; // Ignore top level checks for -Os stubs. if ( !pMemory ) return; PNDR_FCDEF_CORRELATION pFormatCorr = (PNDR_FCDEF_CORRELATION) pFormat; // // First check if this is a callback to an expression evaluation routine. // if ( pFormatCorr->Operation == FC_CALLBACK ) { uchar * pOldStackTop; ushort Index; // Index into expression callback routines table. Index = (ushort) pFormatCorr->Offset; NDR_ASSERT(pStubMsg->StubDesc->apfnExprEval != 0, "NdrpComputeConformance : no expr eval routines"); NDR_ASSERT(pStubMsg->StubDesc->apfnExprEval[Index] != 0, "NdrpComputeConformance : bad expr eval routine index"); pOldStackTop = pStubMsg->StackTop; // // The callback routine uses the StackTop field of the stub message // to base it's offsets from. So if this is a complex attribute for // an embedded field of a structure then set StackTop equal to the // pointer to the structure. // if ( (*pFormat & 0xf0) != FC_TOP_LEVEL_CONFORMANCE ) { pStubMsg->StackTop = pMemory; } // // This call puts the result in pStubMsg->MaxCount. // (*pStubMsg->StubDesc->apfnExprEval[Index])( pStubMsg ); pStubMsg->StackTop = pOldStackTop; if ( CheckKind == NDR_CHECK_OFFSET ) pStubMsg->MaxCount = pStubMsg->Offset; goto ValidateValue; } if ( CheckKind == NDR_CHECK_OFFSET ) { // Checking offset without a call to expr eval routine - // this means that the offset should be zero. pStubMsg->MaxCount = 0; goto ValidateValue; } if ( (*pFormat & 0xf0) == FC_NORMAL_CONFORMANCE ) { // Get the address where the conformance variable is in the struct. pCount = pMemory + pFormatCorr->Offset; goto ComputeConformantGetCount; } // See if this is an async split if ( pFormat[1] & 0x20 ) { fAsyncSplit = TRUE; RpcpMemoryCopy( & FormatCopy[0], pFormat, 4 ); pFormat = (PFORMAT_STRING) & FormatCopy[0]; // Remove the async marker FormatCopy[1] = pFormat[1] & 0xdf; // ~0x20 } // // Get a pointer to the conformance describing variable. // if ( (*pFormat & 0xf0) == FC_TOP_LEVEL_CONFORMANCE ) { // // Top level conformance. For /Os stubs, the stubs put the max // count in the stub message. For /Oi stubs, we get the max count // via an offset from the stack top. // if ( pStubMsg->StackTop ) { if ( fAsyncSplit ) { PNDR_DCOM_ASYNC_MESSAGE pAsyncMsg; pAsyncMsg = (PNDR_DCOM_ASYNC_MESSAGE) pStubMsg->pAsyncMsg; pCount = pAsyncMsg->BeginStack + (ushort)pFormatCorr->Offset; } else pCount = pStubMsg->StackTop + (ushort)pFormatCorr->Offset; goto ComputeConformantGetCount; } else { // Top level conformance with -Os - not supported yet. // // If this is top level conformance with /Os then // a) For early correlation, the compiler should generate the code to // assign appropriate value to pStubMsg->MaxCount. // goto ValideValue // b) For late correlation, we should have a registration call generated, // so there would be nothing to do. // return; } } // // If we're computing the size of an embedded sized pointer then we // use the memory pointer in the stub message, which points to the // beginning of the embedding structure. // if ( (*pFormat & 0xf0) == FC_POINTER_CONFORMANCE ) { pCount = pMemory + pFormatCorr->Offset; goto ComputeConformantGetCount; } // // Check for constant size/switch. // if ( (*pFormat & 0xf0) == FC_CONSTANT_CONFORMANCE ) { // // The size/switch is contained in the lower three bytes of the // long currently pointed to by pFormat. // Count = (ULONG_PTR)pFormat[1] << 16; Count |= (ULONG_PTR) *((ushort *)(pFormat + 2)); goto ComputeConformanceEnd; } // // Check for conformance of a multidimensional array element in // a -Os stub. // if ( (*pFormat & 0xf0) == FC_TOP_LEVEL_MULTID_CONFORMANCE ) { long Dimension; if ( fAsyncSplit ) RpcRaiseException( RPC_X_WRONG_STUB_VERSION ); // // If pArrayInfo is non-null than we have a multi-D array. If it // is null then we have multi-leveled sized pointers. // if ( pStubMsg->pArrayInfo ) { Dimension = pStubMsg->pArrayInfo->Dimension; pStubMsg->MaxCount = pStubMsg->pArrayInfo->MaxCountArray[Dimension]; } else { Dimension = *((ushort *)(pFormat + 2)); pStubMsg->MaxCount = pStubMsg->SizePtrCountArray[Dimension]; } goto ValidateValue; } NDR_ASSERT(0, "NdrpValidateCorrelatedValue:, Invalid Correlation type"); RpcRaiseException( RPC_S_INTERNAL_ERROR ); return; ComputeConformantGetCount: // // Must check now if there is a dereference op. // if ( pFormatCorr->Operation == FC_DEREFERENCE ) { pCount = *(void **)pCount; } // // If we're supposed to whack the value instead of checking it do it // and quit // if ( fResetValue ) { // hypers are not legal types for cs_char size/length_is expressions if ( FC_HYPER == pFormatCorr->Type ) RpcRaiseException( RPC_X_BAD_STUB_DATA ); CHECK_BOUND( (long)Value, pFormatCorr->Type ); switch ( pFormatCorr->Type ) { case FC_ULONG: * (ulong *) pCount = (ulong) Value; return; case FC_LONG: * (ulong *) pCount = (long) Value; return; case FC_ENUM16 : case FC_USHORT : * (ushort *) pCount = (ushort) Value; return; case FC_SHORT : * (short *) pCount = (short) Value; return; case FC_USMALL : * (uchar *) pCount = (uchar) Value; return; case FC_SMALL : * (char *) pCount = (char) Value; return; default : NDR_ASSERT(0,"NdrpValidateCorrelatedValue : bad reset type"); RpcRaiseException( RPC_S_INTERNAL_ERROR ); } } // // Now get the conformance count. // switch ( pFormatCorr->Type ) { case FC_HYPER : // iid_is on 64b platforms only. Count = *((LONG_PTR *)pCount); break; case FC_ULONG : Count = (LONG_PTR)*((ulong *)pCount); break; case FC_LONG : Count = *((long *)pCount); break; case FC_ENUM16: case FC_USHORT : Count = (long) *((ushort *)pCount); break; case FC_SHORT : Count = (long) *((short *)pCount); break; case FC_USMALL : Count = (long) *((uchar *)pCount); break; case FC_SMALL : Count = (long) *((char *)pCount); break; default : NDR_ASSERT(0,"NdrpValidateCorrelatedValue : bad count type"); RpcRaiseException( RPC_S_INTERNAL_ERROR ); } // // Check the operator. // switch ( pFormatCorr->Operation ) { case FC_DIV_2 : Count /= 2; break; case FC_MULT_2 : Count *= 2; break; case FC_SUB_1 : Count -= 1; break; case FC_ADD_1 : Count += 1; break; default : // OK break; } ComputeConformanceEnd: pStubMsg->MaxCount = (ulong) Count; ValidateValue: // Compare pStubMsg->MaxCount with the value BOOL fValueOK = FALSE; LONG_PTR ArgValue = (LONG_PTR) pStubMsg->MaxCount; unsigned char FcType = (uchar)pFormatCorr->Type; if ( (*pFormat & 0xf0) == FC_CONSTANT_CONFORMANCE || pFormatCorr->Operation == FC_CALLBACK ) FcType = FC_ULONG; switch ( FcType ) { case FC_HYPER : fValueOK = ArgValue == (LONG_PTR)Value; break; case FC_ULONG : fValueOK = ArgValue == (LONG_PTR)(ulong)Value; break; case FC_LONG : fValueOK = ArgValue == (LONG_PTR)(long)Value; break; case FC_ENUM16: case FC_USHORT : fValueOK = ArgValue == (LONG_PTR)(ushort)Value; break; case FC_SHORT : fValueOK = ArgValue == (LONG_PTR)(short)Value; break; case FC_USMALL : fValueOK = ArgValue == (LONG_PTR)(uchar)Value; break; case FC_SMALL : fValueOK = ArgValue == (LONG_PTR)(char)Value; break; default : NDR_ASSERT(0,"NdrpValidateCorrelatedValue : bad count type"); RpcRaiseException( RPC_S_INTERNAL_ERROR ); } if ( ! fValueOK ) { if ( ! pFormatCorr->CorrFlags.IsIidIs ) RpcRaiseException( RPC_X_BAD_STUB_DATA ); else { // For interface pointers the check is more complicated. // Value is in this case a pointer to the value, actually. IID * piidValue = (IID *)Value; IID * piidArg = (IID *)ArgValue; if ( 0 != memcmp( piidValue, piidArg, sizeof( IID ))) RpcRaiseException( RPC_X_BAD_STUB_DATA ); } } return; } RPCRTAPI void RPC_ENTRY NdrCorrelationInitialize( PMIDL_STUB_MESSAGE pStubMsg, void * pCache, unsigned long CacheSize, unsigned long Flags ) /* Initializes the correlation package for -Os stubs. */ { PNDR_CORRELATION_INFO pCorrInfo = (PNDR_CORRELATION_INFO)pCache; if ( CacheSize == 0xffffffff ) CacheSize = NDR_DEFAULT_CORR_CACHE_SIZE; pCorrInfo->Header.pCache = (NDR_CORRELATION_INFO *)pCache; pCorrInfo->Header.pInfo = (NDR_CORRELATION_INFO *)pCache; pCorrInfo->Header.DataLen = 0; pCorrInfo->Header.DataSize = (CacheSize - sizeof(NDR_CORRELATION_INFO)) / sizeof(NDR_CORRELATION_INFO_DATA); pStubMsg->pCorrMemory = pStubMsg->StackTop; pStubMsg->pCorrInfo = (NDR_CORRELATION_INFO *)pCache; pStubMsg->fHasExtensions = 1; pStubMsg->fHasNewCorrDesc = 1; } void NdrpAddCorrelationData( PMIDL_STUB_MESSAGE pStubMsg, uchar * pMemory, PFORMAT_STRING pFormat, LONG_PTR Value, int CheckKind ) /* Adds a check data to the correlation data base for a later evaluation. */ { ASSERT( pStubMsg->pCorrInfo ); PNDR_CORRELATION_INFO pCorrInfo = (PNDR_CORRELATION_INFO)pStubMsg->pCorrInfo; if ( pCorrInfo->Header.DataSize <= pCorrInfo->Header.DataLen ) { // Not enough space, need to realloc. unsigned long NewDataSize; PNDR_CORRELATION_INFO pCorrInfoNew; NewDataSize = 2 * pCorrInfo->Header.DataSize; pCorrInfoNew = (PNDR_CORRELATION_INFO) I_RpcAllocate( sizeof(NDR_CORRELATION_INFO_HEADER) + NewDataSize * sizeof(NDR_CORRELATION_INFO_DATA) ); if ( ! pCorrInfoNew ) RpcRaiseException( RPC_S_OUT_OF_MEMORY ); RpcpMemoryCopy( pCorrInfoNew, pCorrInfo, sizeof(NDR_CORRELATION_INFO_HEADER) + pCorrInfo->Header.DataSize * sizeof(NDR_CORRELATION_INFO_DATA) ); pCorrInfoNew->Header.pInfo = pCorrInfoNew; pCorrInfoNew->Header.DataSize = NewDataSize; pStubMsg->pCorrInfo = pCorrInfoNew; if ( pCorrInfo->Header.pInfo != pCorrInfo->Header.pCache ) I_RpcFree( pCorrInfo->Header.pInfo ); pCorrInfo = pCorrInfoNew; } pCorrInfo->Data[ pCorrInfo->Header.DataLen ].pMemoryObject = pMemory; pCorrInfo->Data[ pCorrInfo->Header.DataLen ].Value = Value; pCorrInfo->Data[ pCorrInfo->Header.DataLen ].pCorrDesc = pFormat; pCorrInfo->Data[ pCorrInfo->Header.DataLen ].CheckKind = CheckKind; pCorrInfo->Header.DataLen++; } RPCRTAPI void RPC_ENTRY NdrCorrelationPass( PMIDL_STUB_MESSAGE pStubMsg ) /* Walks the data base to check all the correlated values that could not be checked on fly. */ { ASSERT( pStubMsg->pCorrInfo ); if ( pStubMsg->pCorrInfo->Header.DataLen == 0 ) return; PNDR_CORRELATION_INFO pCorrInfo = (PNDR_CORRELATION_INFO)pStubMsg->pCorrInfo; for ( int i = 0; i < pCorrInfo->Header.DataLen; i++ ) { NdrpValidateCorrelatedValue( pStubMsg, pCorrInfo->Data[ i ].pMemoryObject, pCorrInfo->Data[ i ].pCorrDesc, pCorrInfo->Data[ i ].Value, pCorrInfo->Data[ i ].CheckKind ); } } RPCRTAPI void RPC_ENTRY NdrCorrelationFree( PMIDL_STUB_MESSAGE pStubMsg ) /* Releases the correlation data structures. In /Os stub, NdrCorrelationInitialize is called after fullpointer initialization and NdrCorrelationFree is called without checking pStubMsg->pCorrInfo. changing ndr might be better in this case. */ { // ASSERT( pStubMsg->pCorrInfo ); PNDR_CORRELATION_INFO pCorrInfo = (PNDR_CORRELATION_INFO)pStubMsg->pCorrInfo; if ( NULL == pCorrInfo ) return; if ( pCorrInfo->Header.pInfo != pCorrInfo->Header.pCache ) { I_RpcFree( pCorrInfo->Header.pInfo ); } } HRESULT NdrpGetRpcHelper( IRpcHelper ** ppRpcHelper ) /*++ This routine attempts to get hold of an IRpcHelper interface pointer. We cache the one IP on each process and never release it. This is an inproc server and interface will be cleanup when process exit. --*/ { HRESULT hr; static IRpcHelper *pRpcHelper = NULL; *ppRpcHelper = NULL; if (pRpcHelper) { *ppRpcHelper = pRpcHelper; hr = S_OK; } else { hr = NdrLoadOleRoutines(); if (SUCCEEDED(hr)) hr = (*pfnCoCreateInstance)( CLSID_RpcHelper, NULL, CLSCTX_INPROC_SERVER, IID_IRpcHelper, (void **)&pRpcHelper ); if (SUCCEEDED(hr)) *ppRpcHelper = pRpcHelper; } return hr; } void NdrpGetIIDFromBuffer( PMIDL_STUB_MESSAGE pStubMsg, IID ** ppIID ) /* The routine recovers an interface pointer IID from the marshaling buffer. The IID stays in the buffer, an IID* is returned by the routine. */ { IRpcHelper * pRpcHelper = 0; HRESULT hr; *ppIID = 0; hr = NdrpGetRpcHelper( & pRpcHelper ); if(FAILED(hr)) RpcRaiseException(hr); hr = pRpcHelper->GetIIDFromOBJREF( pStubMsg->Buffer, ppIID ); if (FAILED(hr)) RpcRaiseException( RPC_X_BAD_STUB_DATA ); // The IRpcHelper is cached in NdrpGetRpcHelper so we don't need to release it. // pRpcHelper->Release(); }