3party/mimalloc
0
0
Fork 0
mirror of https://github.com/microsoft/mimalloc.git synced 2025-01-14 08:37:59 +08:00
Code Issues Projects Releases Wiki Activity

add padding check in usable size

Browse Source
This commit is contained in:
daan 2020-04-06 13:42:39 -07:00
parent a38abae0a1
commit 083392fa15
2 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/alloc.c
View File

@ -213,7 +213,8 @@ static bool mi_page_decode_padding(const mi_page_t* page, const mi_block_t* bloc
static size_t mi_page_usable_size_of(const mi_page_t* page, const mi_block_t* block) {
size_t bsize;
size_t delta;
bool ok = mi_page_decode_padding(page, block, &delta, &bsize);
bool ok = mi_page_decode_padding(page, block, &delta, &bsize);
if (!ok) { mi_check_padding(page, block); }
mi_assert_internal(ok); mi_assert_internal(delta <= bsize);
return (ok ? bsize - delta : 0);
}

14
test/main-override-static.c
View File

@ -17,9 +17,9 @@ int main() {
mi_version();
// detect double frees and heap corruption
double_free1();
double_free2();
corrupt_free();
// double_free1();
// double_free2();
// corrupt_free();
block_overflow1();
// dangling_ptr_write();
@ -98,8 +98,8 @@ static void double_free2() {
// Try to corrupt the heap through buffer overflow
#define N 256
#define SZ 64
#define N 1024
#define SZ 40
static void corrupt_free() {
void* p[N];
@ -115,12 +115,12 @@ static void corrupt_free() {
// try to corrupt the free list
for (int i = 0; i < N; i++) {
if (p[i] != NULL) {
memset(p[i], 0, SZ+8);
memset(p[i], 0, SZ+32);
}
}
// allocate more.. trying to trigger an allocation from a corrupted entry
// this may need many allocations to get there (if at all)
for (int i = 0; i < 4096; i++) {
for (int i = 0; i < 4*4096; i++) {
malloc(SZ);
}
}