GitList

Browse code

hardening: add insurance to exit on a failed ASSERT()

The code behind our ASSERT() macro is pretty complex. Although it seems
to be correct, make it trivially clear we will never return from a failed
assert by adding an _exit(1) call. As was suggested by Sebastian Krahmer
of the SuSE security team.

To make sure they that tools like clang static analyzer and coverity
understand that assert_failed() will not return, add an
__attribute__((__noreturn__)) annotation.

v2: use __attribute__ instead of inline to convince static analysers.

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1445414886-11052-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/10349
Signed-off-by: Gert Doering <gert@greenie.muc.de>

Steffan Karger authored on 2015/10/21 17:08:06
Showing 2 changed files

src/openvpn/error.c

History View file @ e8a9e32

@@ -397,6 +397,7 @@ void
 assert_failed (const char *filename, int line)
 {
   msg (M_FATAL, "Assertion failed at %s:%d", filename, line);
+  _exit(1);
 }
 
 /*

src/openvpn/error.h

History View file @ e8a9e32

@@ -210,7 +210,7 @@ FILE *msg_fp(const unsigned int flags);
                      /* Fatal logic errors */
                      #define ASSERT(x) do { if (!(x)) assert_failed(__FILE__, __LINE__); } while (false)
                     -void assert_failed (const char *filename, int line);
                     +void assert_failed (const char *filename, int line) __attribute__((__noreturn__));
                      #ifdef ENABLE_DEBUG
                      void crash (void); /* force a segfault (debugging only) */

...	...	@@ -397,6 +397,7 @@ void
397	397	assert_failed (const char *filename, int line)
398	398	{
399	399	msg (M_FATAL, "Assertion failed at %s:%d", filename, line);
	400	+ _exit(1);
400	401	}
401	402
402	403	/*