diff --git a/ide/vs2019/mimalloc-override-test.vcxproj b/ide/vs2019/mimalloc-override-test.vcxproj
index 7a9202f1..85518e0d 100644
--- a/ide/vs2019/mimalloc-override-test.vcxproj
+++ b/ide/vs2019/mimalloc-override-test.vcxproj
@@ -115,6 +115,8 @@
Sync
Default
false
+
+
Console
diff --git a/src/random.c b/src/random.c
index 05c5c99c..48b4ec96 100644
--- a/src/random.c
+++ b/src/random.c
@@ -167,7 +167,7 @@ If we cannot get good randomness, we fall back to weak randomness based on a tim
#if defined(_WIN32)
-#if !defined(MI_USE_RTLGENRANDOM)
+#if defined(MI_USE_BCRYPTGENRANDOM)
// We prefer BCryptGenRandom over RtlGenRandom
#pragma comment (lib,"bcrypt.lib")
#include
diff --git a/test/main-override.cpp b/test/main-override.cpp
index 8834f2c7..90606afb 100644
--- a/test/main-override.cpp
+++ b/test/main-override.cpp
@@ -37,18 +37,20 @@ static void fail_aslr(); // issue #372
static void tsan_numa_test(); // issue #414
static void strdup_test(); // issue #445
static void bench_alloc_large(void); // issue #xxx
+static void corrupt_free();
int main() {
mi_stats_reset(); // ignore earlier allocations
- heap_thread_free_large();
- heap_no_delete();
- heap_late_free();
- padding_shrink();
- various_tests();
- large_alloc();
- tsan_numa_test();
- strdup_test();
+ heap_thread_free_large();
+ heap_no_delete();
+ heap_late_free();
+ padding_shrink();
+ various_tests();
+ large_alloc();
+ tsan_numa_test();
+ strdup_test();
+ // corrupt_free();
//test_mt_shutdown();
//fail_aslr();
@@ -257,6 +259,41 @@ static void tsan_numa_test() {
t1.join();
}
+
+// Try to corrupt the heap through buffer overflow
+#define N 256
+#define SZ 64
+#define OVF_SZ 32
+
+static void corrupt_free() {
+ void* p[N];
+ // allocate
+ for (int i = 0; i < N; i++) {
+ p[i] = malloc(SZ);
+ }
+ // free some
+ for (int i = 0; i < N; i += (N/10)) {
+ free(p[i]);
+ p[i] = NULL;
+ }
+ // try to corrupt the free list
+ for (int i = 0; i < N; i++) {
+ if (p[i] != NULL) {
+ memset(p[i], 0, SZ+OVF_SZ);
+ }
+ }
+ // allocate more.. trying to trigger an allocation from a corrupted entry
+ // this may need many allocations to get there (if at all)
+ for (int i = 0; i < 4096; i++) {
+ malloc(SZ);
+ }
+ // free the rest
+ for (int i = 0; i < N; i++) {
+ free(p[i]);
+ p[i] = NULL;
+ }
+}
+
// issue #?
#include
#include