test with dynamic override

ide/vs2019/mimalloc-override-test.vcxproj

@@ -115,6 +115,8 @@
       <ExceptionHandling>Sync</ExceptionHandling>
       <CompileAs>Default</CompileAs>
       <SupportJustMyCode>false</SupportJustMyCode>
+      <PreprocessorDefinitions>
+      </PreprocessorDefinitions>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>

src/random.c

@@ -167,7 +167,7 @@ If we cannot get good randomness, we fall back to weak randomness based on a tim
 
 #if defined(_WIN32)
 
-#if !defined(MI_USE_RTLGENRANDOM)
+#if defined(MI_USE_BCRYPTGENRANDOM)
 // We prefer BCryptGenRandom over RtlGenRandom
 #pragma comment (lib,"bcrypt.lib")
 #include <bcrypt.h>

test/main-override.cpp

@@ -37,18 +37,20 @@ static void fail_aslr();              // issue #372
 static void tsan_numa_test();         // issue #414
 static void strdup_test();            // issue #445 
 static void bench_alloc_large(void);  // issue #xxx
+static void corrupt_free();
 
 int main() {
   mi_stats_reset();  // ignore earlier allocations
 
-   heap_thread_free_large();
-   heap_no_delete();
-   heap_late_free();
-   padding_shrink();
-   various_tests();
-   large_alloc();
-   tsan_numa_test();
-   strdup_test();
+  heap_thread_free_large();
+  heap_no_delete();
+  heap_late_free();
+  padding_shrink();
+  various_tests();
+  large_alloc();
+  tsan_numa_test();
+  strdup_test();
+  // corrupt_free();
 
   //test_mt_shutdown();
   //fail_aslr();
@@ -257,6 +259,41 @@ static void tsan_numa_test() {
   t1.join();
 }
 
+
+// Try to corrupt the heap through buffer overflow
+#define N   256
+#define SZ  64
+#define OVF_SZ 32
+
+static void corrupt_free() {
+  void* p[N];
+  // allocate
+  for (int i = 0; i < N; i++) {
+    p[i] = malloc(SZ);
+  }
+  // free some
+  for (int i = 0; i < N; i += (N/10)) {
+    free(p[i]);
+    p[i] = NULL;
+  }
+  // try to corrupt the free list
+  for (int i = 0; i < N; i++) {
+    if (p[i] != NULL) {
+      memset(p[i], 0, SZ+OVF_SZ);
+    }
+  }
+  // allocate more.. trying to trigger an allocation from a corrupted entry
+  // this may need many allocations to get there (if at all)
+  for (int i = 0; i < 4096; i++) {
+    malloc(SZ);
+  }
+  // free the rest
+  for (int i = 0; i < N; i++) {
+    free(p[i]);
+    p[i] = NULL;
+  }
+}
+
 // issue #?
 #include <chrono>
 #include <random>