TheArchive/Magisk
1
0
Fork 0
mirror of https://github.com/topjohnwu/Magisk.git synced 2024-12-27 10:57:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent stack overflow when managing hide list

Browse Source
This commit is contained in:
topjohnwu 2018-11-07 22:46:56 -05:00
parent 59ba350f34
commit be5f00aa1a
1 changed files with 40 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
native/jni/magiskhide/hide_utils.cpp
View File

@ -27,8 +27,10 @@ static const char *prop_value[] =
"enforcing", "0", "0", "0", "enforcing", "0", "0", "0",
"1", "user", "release-keys", "0", nullptr }; "1", "user", "release-keys", "0", nullptr };
static const char *proc_name; struct ps_arg {
static gid_t proc_gid; const char *name;
uid_t uid;
};
void manage_selinux() { void manage_selinux() {
char val; char val;
@ -53,8 +55,7 @@ void hide_sensitive_props() {
} }
} }
/* Call func for each process */ static void ps(void (*cb)(int, void*), void *arg) {
static void ps(void (*func)(int)) {
DIR *dir; DIR *dir;
struct dirent *entry; struct dirent *entry;
@ -62,69 +63,70 @@ static void ps(void (*func)(int)) {
return; return;
while ((entry = xreaddir(dir))) { while ((entry = xreaddir(dir))) {
if (entry->d_type == DT_DIR) { if (entry->d_type == DT_DIR && is_num(entry->d_name))
if (is_num(entry->d_name)) cb(atoi(entry->d_name), arg);
func(atoi(entry->d_name));
}
} }
closedir(dir); closedir(dir);
} }
static int check_proc_name(int pid, const char *name) { static bool check_proc_name(int pid, const char *name) {
char buf[128]; char buf[4019];
FILE *f; FILE *f;
sprintf(buf, "/proc/%d/comm", pid); sprintf(buf, "/proc/%d/comm", pid);
if ((f = fopen(buf, "r"))) { if ((f = fopen(buf, "r"))) {
fgets(buf, sizeof(buf), f); fgets(buf, sizeof(buf), f);
if (strcmp(buf, name) == 0) if (strcmp(buf, name) == 0)
return 1; return true;
} else { } else {
// The PID is already killed // The PID is already killed
return 0; return false;
} }
fclose(f); fclose(f);
sprintf(buf, "/proc/%d/cmdline", pid); sprintf(buf, "/proc/%d/cmdline", pid);
f = fopen(buf, "r"); if ((f = fopen(buf, "r"))) {
fgets(buf, sizeof(buf), f); fgets(buf, sizeof(buf), f);
if (strcmp(basename(buf), name) == 0)
return true;
} else {
// The PID is already killed
return false;
}
fclose(f); fclose(f);
if (strcmp(basename(buf), name) == 0)
return 1;
sprintf(buf, "/proc/%d/exe", pid); sprintf(buf, "/proc/%d/exe", pid);
if (access(buf, F_OK) != 0) if (access(buf, F_OK) != 0)
return 0; return false;
xreadlink(buf, buf, sizeof(buf)); xreadlink(buf, buf, sizeof(buf));
if (strcmp(basename(buf), name) == 0) return strcmp(basename(buf), name) == 0;
return 1;
return 0;
} }
static void kill_proc_cb(int pid) { static void kill_proc_cb(int pid, void *v) {
if (check_proc_name(pid, proc_name)) ps_arg *args = static_cast<ps_arg *>(v);
if (check_proc_name(pid, args->name))
kill(pid, SIGTERM); kill(pid, SIGTERM);
else if (proc_gid > 0) { else if (args->uid > 0) {
char buf[128]; char buf[64];
struct stat st; struct stat st;
sprintf(buf, "/proc/%d", pid); sprintf(buf, "/proc/%d", pid);
stat(buf, &st); stat(buf, &st);
if (proc_gid == st.st_gid) if (args->uid == st.st_uid)
kill(pid, SIGTERM); kill(pid, SIGTERM);
} }
} }
static void kill_process(const char *name) { static void kill_process(const char *name) {
proc_name = name; ps_arg args = { .name = name };
char buf[128];
struct stat st; struct stat st;
sprintf(buf, "/data/data/%s", name); int fd = xopen("/data/data", O_RDONLY | O_CLOEXEC);
if (stat(buf, &st) == 0) if (fstatat(fd, name, &st, 0) == 0)
proc_gid = st.st_gid; args.uid = st.st_uid;
else else
proc_gid = 0; args.uid = 0;
ps(kill_proc_cb); close(fd);
ps(kill_proc_cb, &args);
} }
void clean_magisk_props() { void clean_magisk_props() {
@ -143,16 +145,16 @@ static int add_list(sqlite3 *db, const char *proc) {
} }
LOGI("hide_list add: [%s]\n", proc); LOGI("hide_list add: [%s]\n", proc);
kill_process(proc);
// Critical region // Critical region
pthread_mutex_lock(&list_lock); pthread_mutex_lock(&list_lock);
hide_list.push_back(proc); hide_list.push_back(proc);
kill_process(proc);
pthread_mutex_unlock(&list_lock); pthread_mutex_unlock(&list_lock);
// Add to database // Add to database
char sql[128]; char sql[4096];
sprintf(sql, "INSERT INTO hidelist (process) VALUES('%s')", proc); snprintf(sql, sizeof(sql), "INSERT INTO hidelist (process) VALUES('%s')", proc);
sqlite3_exec(db, sql, nullptr, nullptr, nullptr); sqlite3_exec(db, sql, nullptr, nullptr, nullptr);
return DAEMON_SUCCESS; return DAEMON_SUCCESS;
@ -184,18 +186,18 @@ static int rm_list(const char *proc) {
do_rm = true; do_rm = true;
LOGI("hide_list rm: [%s]\n", proc); LOGI("hide_list rm: [%s]\n", proc);
hide_list.erase(it); hide_list.erase(it);
kill_process(proc);
break; break;
} }
} }
pthread_mutex_unlock(&list_lock); pthread_mutex_unlock(&list_lock);
if (do_rm) { if (do_rm) {
kill_process(proc);
sqlite3 *db = get_magiskdb(); sqlite3 *db = get_magiskdb();
if (db == nullptr) if (db == nullptr)
return DAEMON_ERROR; return DAEMON_ERROR;
char sql[128]; char sql[4096];
sprintf(sql, "DELETE FROM hidelist WHERE process='%s'", proc); snprintf(sql, sizeof(sql), "DELETE FROM hidelist WHERE process='%s'", proc);
sqlite3_exec(db, sql, nullptr, nullptr, nullptr); sqlite3_exec(db, sql, nullptr, nullptr, nullptr);
sqlite3_close_v2(db); sqlite3_close_v2(db);
return DAEMON_SUCCESS; return DAEMON_SUCCESS;