3party/crashpad
0
0
Fork 0
mirror of https://github.com/chromium/crashpad.git synced 2025-03-10 06:36:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

MachMessageServer: scribble over memory allocations in debug mode.

Browse Source 
This exposed a bug in the ExcClientVariants test, which was expecting
the memory used for new_state to be initialized with zeroes. In reality,
no guarantee of initialization is made. MIG “out” parameters are
strictly “out” and may contain garbage at function entry.

TEST=util_test
R=rsesek@chromium.org

Review URL: https://codereview.chromium.org/779633004
This commit is contained in:
Mark Mentovai 2014-12-03 18:24:27 -05:00
parent 9f520e3fbf
commit 86588c5526
2 changed files with 23 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
util/mach/exc_client_variants_test.cc
View File

@ -117,7 +117,6 @@ class TestExcClientVariants : public UniversalMachExcServer,
// Send a new state back to the client. // Send a new state back to the client.
for (size_t index = 0; index < *new_state_count; ++index) { for (size_t index = 0; index < *new_state_count; ++index) {
EXPECT_EQ(0u, new_state[index]);
new_state[index] = MACHINE_THREAD_STATE_COUNT - index; new_state[index] = MACHINE_THREAD_STATE_COUNT - index;
} }
} else { } else {

15
util/mach/mach_message_server.cc
View File

@ -14,6 +14,8 @@
#include "util/mach/mach_message_server.h" #include "util/mach/mach_message_server.h"
#include <string.h>
#include <limits> #include <limits>
#include "base/logging.h" #include "base/logging.h"
@ -48,10 +50,7 @@ class MachMessageBuffer {
// This test uses == instead of > so that a large reallocation to receive a // This test uses == instead of > so that a large reallocation to receive a
// large message doesn’t cause permanent memory bloat for the duration of // large message doesn’t cause permanent memory bloat for the duration of
// a MachMessageServer::Run() loop. // a MachMessageServer::Run() loop.
if (size == vm_.size()) { if (size != vm_.size()) {
return KERN_SUCCESS;
}
// reset() first, so that two allocations don’t exist simultaneously. // reset() first, so that two allocations don’t exist simultaneously.
vm_.reset(); vm_.reset();
@ -68,6 +67,14 @@ class MachMessageBuffer {
vm_.reset(address, size); vm_.reset(address, size);
} }
}
#if !defined(NDEBUG)
// Regardless of whether the allocation was changed, scribble over the
// memory to make sure that nothing relies on zero-initialization or stale
// contents.
memset(Header(), 0x66, size);
#endif
return KERN_SUCCESS; return KERN_SUCCESS;
} }