Improvements to X86FixupGadgets pass of clang(1)
by from OpenBSD Journal on (#49V0X)
Todd Mortimer (mortimer@) hascommittedimprovements to (the anti-ROP)"X86FixupGadgets" passofclang(1)for amd64 and i386:
CVSROOT:/cvsModule name:srcChanges by:mortimer@cvs.openbsd.org2019/02/22 08:28:43Modified files:gnu/llvm/lib/Target/X86: X86FixupGadgets.cpp X86InstrCompiler.td X86MCInstLower.cpp gnu/llvm/tools/clang/include/clang/Driver: Options.td gnu/llvm/tools/clang/lib/Driver/ToolChains: Clang.cpp share/man/man1 : clang-local.1 Log message:Improve the X86FixupGadgets pass:- Target all four kinds of return bytes (c2, c3, ca, cb)- Fix up instructions using both ModR/M and SIB bytes- Force alignment before instructions with return bytes in immediates- Force alignment before instructions that have return bytes in their encoding- Add a command line switch to toggle the functionality.ok deraadt@
This extends the previous work to cover even more cases which (previously potentially) could be exploited as return instructions.