kiper220/mimalloc
1
0
Fork 0
mirror of https://github.com/microsoft/mimalloc.git synced 2025-07-06 11:34:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

enable double free and heap corruption detection in debug mode

Browse source
This commit is contained in:
daan 2019-10-28 15:54:33 -07:00
parent 87bdfbb9b6
commit b052d3b731
7 changed files with 104 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

42
test/main-override-static.c
View file

@ -9,11 +9,16 @@
static void double_free1();
static void double_free2();
static void corrupt_free();
int main() {
mi_version();
// detect double frees and heap corruption
//double_free1();
//double_free2();
//corrupt_free();
void* p1 = malloc(78);
void* p2 = malloc(24);
free(p1);
@ -36,9 +41,13 @@ int main() {
return 0;
}
// The double free samples come ArcHeap [1] by Insu Yun (issue #161)
// [1]: https://arxiv.org/pdf/1903.00503.pdf
static void double_free1() {
void* p[256];
uintptr_t buf[256];
//uintptr_t buf[256];
p[0] = mi_malloc(622616);
p[1] = mi_malloc(655362);
@ -54,7 +63,7 @@ static void double_free1() {
static void double_free2() {
void* p[256];
uintptr_t buf[256];
//uintptr_t buf[256];
// [INFO] Command buffer: 0x327b2000
// [INFO] Input size: 182
p[0] = malloc(712352);
@ -69,3 +78,32 @@ static void double_free2() {
// p[4]=0x433f1402000 (size=917504), p[1]=0x433f14c2000 (size=786432)
fprintf(stderr, "p1: %p-%p, p2: %p-%p\n", p[4], (uint8_t*)(p[4]) + 917504, p[1], (uint8_t*)(p[1]) + 786432);
}
// Try to corrupt the heap through buffer overflow
#define N 256
#define SZ 64
static void corrupt_free() {
void* p[N];
// allocate
for (int i = 0; i < N; i++) {
p[i] = malloc(SZ);
}
// free some
for (int i = 0; i < N; i += (N/10)) {
free(p[i]);
p[i] = NULL;
}
// try to corrupt the free list
for (int i = 0; i < N; i++) {
if (p[i] != NULL) {
memset(p[i], 0, SZ+8);
}
}
// allocate more.. trying to trigger an allocation from a corrupted entry
// this may need many allocations to get there (if at all)
for (int i = 0; i < 4096; i++) {
malloc(SZ);
}
}