ios: Actually merge memory snapshot data.

To avoid unnecessary duplication of potentially large memory regions,
the iOS MemorySnapshot data is owned by the intermediate dump. When
merging two iOS memory snapshots, it's necessary to copy the merged
data into a vector owned by the memory snapshot itself.

Previously the merged snapshot just contained the original data, which
leads to a heap overrun.

Bug: 1288544
Change-Id: I4eb392800141451db188d17c7b9f9ca9bd3bb603
Reviewed-on: https://chromium-review.googlesource.com/c/crashpad/crashpad/+/3399252
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Justin Cohen <justincohen@chromium.org>

snapshot/ios/memory_snapshot_ios_intermediate_dump.cc

@@ -50,12 +50,37 @@ bool MemorySnapshotIOSIntermediateDump::Read(Delegate* delegate) const {
 
 const MemorySnapshot* MemorySnapshotIOSIntermediateDump::MergeWithOtherSnapshot(
     const MemorySnapshot* other) const {
+  INITIALIZATION_STATE_DCHECK_VALID(initialized_);
+  auto other_snapshot =
+      reinterpret_cast<const MemorySnapshotIOSIntermediateDump*>(other);
+
+  INITIALIZATION_STATE_DCHECK_VALID(other_snapshot->initialized_);
+  if (other_snapshot->address_ < address_) {
+    return other_snapshot->MergeWithOtherSnapshot(this);
+  }
+
   CheckedRange<uint64_t, size_t> merged(0, 0);
   if (!LoggingDetermineMergedRange(this, other, &merged))
     return nullptr;
 
   auto result = std::make_unique<MemorySnapshotIOSIntermediateDump>();
   result->Initialize(merged.base(), data_, merged.size());
+  if (size_ == merged.size()) {
+    return result.release();
+  }
+
+  const uint8_t* data = reinterpret_cast<const uint8_t*>(data_);
+  const uint8_t* other_data =
+      reinterpret_cast<const uint8_t*>(other_snapshot->data_);
+  vm_size_t overlap = merged.size() - other_snapshot->size_;
+  result->merged_data_.reserve(merged.size());
+  result->merged_data_.insert(result->merged_data_.end(), data, data + overlap);
+  result->merged_data_.insert(result->merged_data_.end(),
+                              other_data,
+                              other_data + other_snapshot->size_);
+  result->data_ =
+      reinterpret_cast<const vm_address_t>(result->merged_data_.data());
+  DCHECK_EQ(result->merged_data_.size(), merged.size());
   return result.release();
 }
 

snapshot/ios/memory_snapshot_ios_intermediate_dump.h

@@ -15,6 +15,8 @@
 #ifndef CRASHPAD_SNAPSHOT_IOS_INTERMEDIATE_DUMP_MEMORY_SNAPSHOT_IOS_INTERMEDIATEDUMP_H_
 #define CRASHPAD_SNAPSHOT_IOS_INTERMEDIATE_DUMP_MEMORY_SNAPSHOT_IOS_INTERMEDIATEDUMP_H_
 
+#include <vector>
+
 #include "snapshot/memory_snapshot.h"
 #include "util/misc/address_types.h"
 #include "util/misc/initialization_state_dcheck.h"
@@ -55,6 +57,12 @@ class MemorySnapshotIOSIntermediateDump final : public MemorySnapshot {
 
   vm_address_t address_;
   vm_address_t data_;
+
+  // Because the iOS snapshot memory region is owned by the intermediate dump,
+  // it's necessary to copy the merged data into a vector owned by the memory
+  // snapshot itself.
+  std::vector<uint8_t> merged_data_;
+
   vm_size_t size_;
   InitializationStateDcheck initialized_;
 };