System, method and computer program product for preventing the execution of unwanted code
View Patent ↗A system, method and computer program product are provided for preventing the execution of unwanted code. In use, it is determined whether an object is associated with a class having diamond inheritance. If it is determined that the object is associated with a class having diamond inheritance, an exploit of the object is prevented.
1. A computer-implemented method using object-oriented programming, comprising:
creating a table of offsets between a parent class and each class that is derived from the parent class;
determining whether an object that is a member of a class hierarchy is associated with a class having diamond inheritance; and
preventing an exploit of the object when it is determined that the object is associated with the class having diamond inheritance, the exploit possible as a result of a vulnerability in a manner in which a compiler implements support for the object associated with the class having diamond inheritance,
wherein the act of preventing the exploit of the object includes performing an integrity check on the object.
2. The method of claim 1 , wherein the class having diamond inheritance is derived from multiple instances of a parent class.
3. The method of claim 1 , wherein the object is associated with a virtual base class.
4. The method of claim 1 , further comprising the act of storing the table in a designated area of memory.
5. The method of claim 4 , wherein the act of storing the table in the designated area of memory includes the act of storing the table in electrically erasable read-only memory.
6. The method of claim 5 , wherein the designated area of the read-only memory is maintained in known address boundaries.
7. The method of claim 1 , wherein the act of creating a table of offsets between classes includes the act of creating the table of offsets at compile-time.
8. The method of claim 1 , wherein the act of preventing the exploit of the object further includes:
identifying a link associated with the object; and
determining whether the link points to a designated area of memory.
9. The method of claim 8 , wherein the act of identifying the link includes the act of identifying a pointer from the object to an associated offset.
10. The method of claim 8 , wherein the act of identifying the link occurs in response to an identification of a code jump from the class having diamond inheritance to a parent class.
11. The method of claim 1 , wherein the act of performing an integrity check on the object includes the act of determining whether the object is contiguously stored with other objects associated with the class.
12. The method of claim 1 , further comprising the act of processing the object when the integrity check indicates that the object is trustworthy.
13. The method of claim 1 , wherein the act of preventing the exploit of the object is carried out at run-time.
14. A computer program product embodied on a non-transitory computer readable medium, comprising instructions to cause a processor to:
create a table of offsets between a parent class and each class that is derived from the parent class;
determine whether an object that is a member of a class hierarchy is associated with a class in the class hierarchy having diamond inheritance; and
prevent an exploit of the object when it is determined that the object is associated with the class having diamond inheritance, the exploit possible as a result of a vulnerability in a manner in which a compiler implements support for the object associated with the class having diamond inheritance,
wherein the instructions to cause the processor to prevent the exploit of the object comprise instructions to cause the processor to perform an integrity check on the object.
15. The method of claim 1 , wherein the act of preventing the exploit of the object further includes at least one of blocking behaviors associated with known exploits and eliminating the vulnerability.
16. The method of claim 1 , wherein the act of performing the integrity check on the object includes the act of determining whether an offset of the class pointed to by the object points to an untrusted object with a characteristic that has been modified.
17. The computer program product embodied on a non-transitory computer readable medium of claim 14 , wherein the class having diamond inheritance is derived from multiple instances of a parent class.
18. The computer program product embodied on a non-transitory computer readable medium of claim 14 , wherein the object is associated with a virtual base class.
19. The computer program product embodied on a non-transitory computer readable medium of claim 14 , wherein the instructions to prevent the exploit of the object further includes instructions to:
identify a link associated with the object; and
determine whether the link points to a designated area of memory.
20. A system, comprising:
a memory; and
a processor operatively coupled to the memory, the processor adapted to execute program code stored in the memory to:
create a table of offsets between a parent class and each class that is derived from the parent class,
determine whether an object that is a member of a class hierarchy is associated with a class having diamond inheritance, and
prevent an exploit of the object when it is determined that the object is associated with the class having diamond inheritance, the exploit possible as a result of a vulnerability in a manner in which a compiler implements support for the object associated with the class having diamond inheritance,
wherein the act of preventing the exploit of the object includes the act of performing an integrity check on the object.