kiper220/mimalloc
1
0
Fork 0
mirror of https://github.com/microsoft/mimalloc.git synced 2025-05-10 01:09:31 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

add padding check in usable size

Browse source
This commit is contained in:
daan 2020-04-06 13:42:39 -07:00
parent a38abae0a1
commit 083392fa15
2 changed files with 9 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/alloc.c
View file

@ -213,7 +213,8 @@ static bool mi_page_decode_padding(const mi_page_t* page, const mi_block_t* bloc
static size_t mi_page_usable_size_of(const mi_page_t* page, const mi_block_t* block) { static size_t mi_page_usable_size_of(const mi_page_t* page, const mi_block_t* block) {
size_t bsize; size_t bsize;
size_t delta; size_t delta;
bool ok = mi_page_decode_padding(page, block, &delta, &bsize); bool ok = mi_page_decode_padding(page, block, &delta, &bsize);
if (!ok) { mi_check_padding(page, block); }
mi_assert_internal(ok); mi_assert_internal(delta <= bsize); mi_assert_internal(ok); mi_assert_internal(delta <= bsize);
return (ok ? bsize - delta : 0); return (ok ? bsize - delta : 0);
} }

14
test/main-override-static.c
View file

@ -17,9 +17,9 @@ int main() {
mi_version(); mi_version();
// detect double frees and heap corruption // detect double frees and heap corruption
double_free1(); // double_free1();
double_free2(); // double_free2();
corrupt_free(); // corrupt_free();
block_overflow1(); block_overflow1();
// dangling_ptr_write(); // dangling_ptr_write();
@ -98,8 +98,8 @@ static void double_free2() {
// Try to corrupt the heap through buffer overflow // Try to corrupt the heap through buffer overflow
#define N 256 #define N 1024
#define SZ 64 #define SZ 40
static void corrupt_free() { static void corrupt_free() {
void* p[N]; void* p[N];
@ -115,12 +115,12 @@ static void corrupt_free() {
// try to corrupt the free list // try to corrupt the free list
for (int i = 0; i < N; i++) { for (int i = 0; i < N; i++) {
if (p[i] != NULL) { if (p[i] != NULL) {
memset(p[i], 0, SZ+8); memset(p[i], 0, SZ+32);
} }
} }
// allocate more.. trying to trigger an allocation from a corrupted entry // allocate more.. trying to trigger an allocation from a corrupted entry
// this may need many allocations to get there (if at all) // this may need many allocations to get there (if at all)
for (int i = 0; i < 4096; i++) { for (int i = 0; i < 4*4096; i++) {
malloc(SZ); malloc(SZ);
} }
} }