* cygtls.cc (dll_cmp): New comparison function for bsearch.

	(well_known_dlls): New array containing well-known DLLs.
	(_cygtls::call2): Add code for BLODA detection.
	* net.cc (fdsock): Ditto.

1 files changed, 60 insertions, 1 deletions

diff --git a/winsup/cygwin/cygtls.cc b/winsup/cygwin/cygtls.cc
index f45cfaa52..7b9c2a827 100644
--- a/winsup/cygwin/cygtls.cc
+++ b/winsup/cygwin/cygtls.cc
@@ -1,6 +1,7 @@
 /* cygtls.cc
 
-   Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Red Hat, Inc.
+   Copyright 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011,
+   2012 Red Hat, Inc.
 
 This software is a copyrighted work licensed under the terms of the
 Cygwin license.  Please consult the file "CYGWIN_LICENSE" for
@@ -62,10 +63,68 @@ _cygtls::call (DWORD (*func) (void *, void *), void *arg)
   _my_tls.call2 (func, arg, buf);
 }
 
+static int
+dll_cmp (const void *a, const void *b)
+{
+  return wcscasecmp ((const wchar_t *) a, *(const wchar_t **) b);
+}
+
+/* Keep sorted!
+   This is a list of well-known core system DLLs which contain code
+   whiuch is started in its own thread by the system.  Kernel32.dll,
+   for instance, contains the thread called on every Ctrl-C keypress
+   in a console window.  The DLLs in this list are not recognized as
+   BLODAs. */
+const wchar_t *well_known_dlls[] =
+{
+  L"kernel32.dll",
+  L"mswsock.dll",
+  L"ntdll.dll",
+  L"ws2_32.dll",
+};
+
 void
 _cygtls::call2 (DWORD (*func) (void *, void *), void *arg, void *buf)
 {
   init_thread (buf, func);
+
+  /* Optional BLODA detection.  The idea is that the function address is
+     supposed to be within Cygwin itself.  This is also true for pthreads,
+     since pthreads are always calling thread_wrapper in miscfuncs.cc. 
+     Therefore, every function call to a function outside of the Cygwin DLL
+     is potentially a thread injected into the Cygwin process by some BLODA.
+
+     But that's a bit too simple.  Assuming the application itself calls
+     CreateThread, then this is a bad idea, but not really invalid.  So we
+     shouldn't print a BLODA message if the address is within the loaded
+     image of the application.  Also, ntdll.dll starts threads into the
+     application which */
+  if (detect_bloda)
+    {
+      PIMAGE_DOS_HEADER img_start = (PIMAGE_DOS_HEADER) GetModuleHandle (NULL);
+      PIMAGE_NT_HEADERS32 ntheader = (PIMAGE_NT_HEADERS32)
+			       ((PBYTE) img_start + img_start->e_lfanew);
+      void *img_end = (void *) ((PBYTE) img_start
+				+ ntheader->OptionalHeader.SizeOfImage);
+      if (((void *) func < (void *) cygwin_hmodule
+	   || (void *) func > (void *) cygheap)
+	  && ((void *) func < (void *) img_start || (void *) func >= img_end))
+	{
+	  MEMORY_BASIC_INFORMATION mbi;
+	  wchar_t modname[PATH_MAX];
+
+	  VirtualQuery ((PVOID) func, &mbi, sizeof mbi);
+	  GetModuleFileNameW ((HMODULE) mbi.AllocationBase, modname, PATH_MAX);
+	  /* Fetch basename and check against list of above system DLLs. */
+	  const wchar_t *modbasename = wcsrchr (modname, L'\\') + 1;
+	  if (!bsearch (modbasename, well_known_dlls,
+			sizeof well_known_dlls / sizeof well_known_dlls[0],
+			sizeof well_known_dlls[0], dll_cmp))
+	    small_printf ("\n\nPotential BLODA detected!  Thread function "
+			  "called outside of Cygwin DLL:\n  %W\n\n", modname);
+	}
+    }
+
   DWORD res = func (arg, buf);
   remove (INFINITE);
   /* Don't call ExitThread on the main thread since we may have been