3party/crashpad
0
0
Fork 0
mirror of https://github.com/chromium/crashpad.git synced 2024-12-26 23:01:05 +08:00
Code Issues Projects Releases Wiki Activity

ios: Actually merge memory snapshot data.

Browse Source 
To avoid unnecessary duplication of potentially large memory regions,
the iOS MemorySnapshot data is owned by the intermediate dump. When
merging two iOS memory snapshots, it's necessary to copy the merged
data into a vector owned by the memory snapshot itself.

Previously the merged snapshot just contained the original data, which
leads to a heap overrun.

Bug: 1288544
Change-Id: I4eb392800141451db188d17c7b9f9ca9bd3bb603
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3399252
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Justin Cohen <justincohen@chromium.org>
This commit is contained in:
Justin Cohen 2022-01-18 18:40:10 -05:00 committed by Crashpad LUCI CQ
parent 9ed7e84644
commit b714b223ad
2 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
snapshot/ios/memory_snapshot_ios_intermediate_dump.cc
View File

@ -50,12 +50,37 @@ bool MemorySnapshotIOSIntermediateDump::Read(Delegate* delegate) const {
const MemorySnapshot* MemorySnapshotIOSIntermediateDump::MergeWithOtherSnapshot(
const MemorySnapshot* other) const {
INITIALIZATION_STATE_DCHECK_VALID(initialized_);
auto other_snapshot =
reinterpret_cast<const MemorySnapshotIOSIntermediateDump*>(other);
INITIALIZATION_STATE_DCHECK_VALID(other_snapshot->initialized_);
if (other_snapshot->address_ < address_) {
return other_snapshot->MergeWithOtherSnapshot(this);
}
CheckedRange<uint64_t, size_t> merged(0, 0);
if (!LoggingDetermineMergedRange(this, other, &merged))
return nullptr;
auto result = std::make_unique<MemorySnapshotIOSIntermediateDump>();
result->Initialize(merged.base(), data_, merged.size());
if (size_ == merged.size()) {
return result.release();
}
const uint8_t* data = reinterpret_cast<const uint8_t*>(data_);
const uint8_t* other_data =
reinterpret_cast<const uint8_t*>(other_snapshot->data_);
vm_size_t overlap = merged.size() - other_snapshot->size_;
result->merged_data_.reserve(merged.size());
result->merged_data_.insert(result->merged_data_.end(), data, data + overlap);
result->merged_data_.insert(result->merged_data_.end(),
other_data,
other_data + other_snapshot->size_);
result->data_ =
reinterpret_cast<const vm_address_t>(result->merged_data_.data());
DCHECK_EQ(result->merged_data_.size(), merged.size());
return result.release();
}

8
snapshot/ios/memory_snapshot_ios_intermediate_dump.h
View File

@ -15,6 +15,8 @@
#ifndef CRASHPAD_SNAPSHOT_IOS_INTERMEDIATE_DUMP_MEMORY_SNAPSHOT_IOS_INTERMEDIATEDUMP_H_
#define CRASHPAD_SNAPSHOT_IOS_INTERMEDIATE_DUMP_MEMORY_SNAPSHOT_IOS_INTERMEDIATEDUMP_H_
#include <vector>
#include "snapshot/memory_snapshot.h"
#include "util/misc/address_types.h"
#include "util/misc/initialization_state_dcheck.h"
@ -55,6 +57,12 @@ class MemorySnapshotIOSIntermediateDump final : public MemorySnapshot {
vm_address_t address_;
vm_address_t data_;
// Because the iOS snapshot memory region is owned by the intermediate dump,
// it's necessary to copy the merged data into a vector owned by the memory
// snapshot itself.
std::vector<uint8_t> merged_data_;
vm_size_t size_;
InitializationStateDcheck initialized_;
};