diff --git a/ide/vs2019/mimalloc-override-test.vcxproj b/ide/vs2019/mimalloc-override-test.vcxproj index 7a9202f1..85518e0d 100644 --- a/ide/vs2019/mimalloc-override-test.vcxproj +++ b/ide/vs2019/mimalloc-override-test.vcxproj @@ -115,6 +115,8 @@ Sync Default false + + Console diff --git a/src/random.c b/src/random.c index 05c5c99c..48b4ec96 100644 --- a/src/random.c +++ b/src/random.c @@ -167,7 +167,7 @@ If we cannot get good randomness, we fall back to weak randomness based on a tim #if defined(_WIN32) -#if !defined(MI_USE_RTLGENRANDOM) +#if defined(MI_USE_BCRYPTGENRANDOM) // We prefer BCryptGenRandom over RtlGenRandom #pragma comment (lib,"bcrypt.lib") #include diff --git a/test/main-override.cpp b/test/main-override.cpp index 8834f2c7..90606afb 100644 --- a/test/main-override.cpp +++ b/test/main-override.cpp @@ -37,18 +37,20 @@ static void fail_aslr(); // issue #372 static void tsan_numa_test(); // issue #414 static void strdup_test(); // issue #445 static void bench_alloc_large(void); // issue #xxx +static void corrupt_free(); int main() { mi_stats_reset(); // ignore earlier allocations - heap_thread_free_large(); - heap_no_delete(); - heap_late_free(); - padding_shrink(); - various_tests(); - large_alloc(); - tsan_numa_test(); - strdup_test(); + heap_thread_free_large(); + heap_no_delete(); + heap_late_free(); + padding_shrink(); + various_tests(); + large_alloc(); + tsan_numa_test(); + strdup_test(); + // corrupt_free(); //test_mt_shutdown(); //fail_aslr(); @@ -257,6 +259,41 @@ static void tsan_numa_test() { t1.join(); } + +// Try to corrupt the heap through buffer overflow +#define N 256 +#define SZ 64 +#define OVF_SZ 32 + +static void corrupt_free() { + void* p[N]; + // allocate + for (int i = 0; i < N; i++) { + p[i] = malloc(SZ); + } + // free some + for (int i = 0; i < N; i += (N/10)) { + free(p[i]); + p[i] = NULL; + } + // try to corrupt the free list + for (int i = 0; i < N; i++) { + if (p[i] != NULL) { + memset(p[i], 0, SZ+OVF_SZ); + } + } + // allocate more.. trying to trigger an allocation from a corrupted entry + // this may need many allocations to get there (if at all) + for (int i = 0; i < 4096; i++) { + malloc(SZ); + } + // free the rest + for (int i = 0; i < N; i++) { + free(p[i]); + p[i] = NULL; + } +} + // issue #? #include #include