[compiler-rt] Add support for relative offset adjustment in interception

[etienneb]

Summary

Some instructions can only be copied if the relative offset is adjusted.

This patch adds support for two common instruction.
It's quite common to have a indirect load in the prologue
(loading the security cookie).

[rnk]

lgtm

[etienneb]

nits

lib/interception/interception_win.cc

if (size <= sizeof(kHintNop10Bytes) &&
     return true;
   return false;
 }
 
 static void WritePadding(uptr from, uptr size) {
   _memset((void*)from, 0xCC, (size_t)size);
 }
 
-static void CopyInstructions(uptr from, uptr to, uptr size) {
-  _memcpy((void*)from, (void*)to, (size_t)size);
-}
-
 static void WriteJumpInstruction(uptr from, uptr target) {
   if (!DistanceIsWithin2Gig(from + kJumpInstructionLength, target))
     InterceptionFailed();
   ptrdiff_t offset = target - from - kJumpInstructionLength;
   *(u8*)from = 0xE9;
   *(u32*)(from + 1) = offset;
 }
 
#endif
   uptr allocated_space = region->content + region->allocated_size;
   region->allocated_size += size;
   WritePadding(allocated_space, size);
 
   return allocated_space;
 }
 
 // Returns 0 on error.
-static size_t GetInstructionSize(uptr address) {
+static size_t GetInstructionSize(uptr address, size_t* rel_offset = nullptr) {
   switch (*(u64*)address) {
     case 0x90909090909006EB:  // stub: jmp over 6 x nop.
       return 8;
   }
 
   switch (*(u8*)address) {
     case 0x90:  // 90 : nop
       return 1;
switch (0x00FFFFFF & *(u32*)address) {
     case 0xf88349:    // 49 83 f8 XX : cmp r8, XX
     case 0x588948:    // 48 89 58 XX : mov QWORD PTR[rax + XX], rbx
       return 4;
 
     case 0x058b48:    // 48 8b 05 XX XX XX XX :
                       //   mov rax, QWORD PTR [rip + XXXXXXXX]
     case 0x25ff48:    // 48 ff 25 XX XX XX XX :
                       //   rex.W jmp QWORD PTR [rip + XXXXXXXX]
-      // Instructions having offset relative to 'rip' cannot be copied.
-      return 0;
+
+      // Instructions having offset relative to 'rip' need offset adjustment.
+      if (rel_offset)
+        *rel_offset = 3;
+      return 7;
 
     case 0x2444c7:    // C7 44 24 XX YY YY YY YY
                       //   mov dword ptr [rsp + XX], YYYYYYYY
       return 8;
   }
 
   switch (*(u32*)(address)) {
     case 0x24448b48:  // 48 8b 44 24 XX : mov rax, QWORD ptr [rsp + XX]
while (cursor < size) {
     size_t instruction_size = GetInstructionSize(address + cursor);
     if (!instruction_size)
       return 0;
     cursor += instruction_size;
   }
   return cursor;
 }
 
+static bool CopyInstructions(uptr to, uptr from, size_t size) {
+  size_t cursor = 0;
+  while (cursor != size) {
+    size_t rel_offset = 0;
+    size_t instruction_size = GetInstructionSize(from + cursor, &rel_offset);
+    _memcpy((void*)(to + cursor), (void*)(from + cursor), (size_t)instruction_size);
+    if (rel_offset) {
+      uptr delta = to - from;
+      uptr relocated_offset = *(u32*)(to + cursor + rel_offset) - delta;
+#if SANITIZER_WINDOWS64
+      if (relocated_offset + 0x80000000U >= 0xFFFFFFFFU)
+        return false;
+#endif
+      *(u32*)(to + cursor + rel_offset) = relocated_offset;
+    }
+    cursor += instruction_size;
+  }
+
+  return true;
+}
+
+
 #if !SANITIZER_WINDOWS64
 bool OverrideFunctionWithDetour(
     uptr old_func, uptr new_func, uptr *orig_old_func) {
   const int kDetourHeaderLen = 5;
   const u16 kDetourInstruction = 0xFF8B;
 
   uptr header = (uptr)old_func - kDetourHeaderLen;
   uptr patch_length = kDetourHeaderLen + kShortJumpInstructionLength;
if (instruction_size < kShortJumpInstructionLength ||
     return false;
 
   if (orig_old_func) {
     // Put the needed instructions into the trampoline bytes.
     uptr trampoline_length = instruction_size + kDirectBranchLength;
     uptr trampoline = AllocateMemoryForTrampoline(old_func, trampoline_length);
     if (!trampoline)
       return false;
-    CopyInstructions(trampoline, old_func, instruction_size);
+    if (!CopyInstructions(trampoline, old_func, instruction_size))
+      return false;
     WriteDirectBranch(trampoline + instruction_size,
                       old_func + instruction_size);
     *orig_old_func = trampoline;
   }
 
   // If needed, get memory space for indirect address.
   uptr indirect_address = 0;
 #if SANITIZER_WINDOWS64
if (orig_old_func) {
     if (!instructions_length)
       return false;
 
     // Put the needed instructions into the trampoline bytes.
     uptr trampoline_length = instructions_length + kDirectBranchLength;
     uptr trampoline = AllocateMemoryForTrampoline(old_func, trampoline_length);
     if (!trampoline)
       return false;
-    CopyInstructions(trampoline, old_func, instructions_length);
+    if (!CopyInstructions(trampoline, old_func, instructions_length))
+      return false;
     WriteDirectBranch(trampoline + instructions_length,
                       old_func + instructions_length);
     *orig_old_func = trampoline;
   }
 
 #if SANITIZER_WINDOWS64
   // Check if the targeted address can be encoded in the function padding.
   // Otherwise, allocate it in the trampoline region.