Cheri-research/snmalloc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for heap corruption

Browse Source 
The allocator id and sizeclass are stored in deallocated objects to
provide quick lookup.  This adds checks that these are actually correct.
This commit is contained in:
Matthew Parkinson
2021-04-08 15:50:34 +01:00
committed by Matthew Parkinson
parent c58a690b30
commit 118eecb2e6
1 changed files with 15 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/mem/alloc.h
View File

@@ -916,18 +916,29 @@ namespace snmalloc
if (likely(sizeclass < NUM_SMALL_CLASSES))
{
SNMALLOC_ASSERT(super->get_kind() == Super);
check_client(
super->get_kind() == Super,
"Heap Corruption: Sizeclass of remote dealloc corrupt.");
auto slab =
Metaslab::get_slab(Aal::capptr_rebound(super.as_void(), p_offseted));
check_client(
super->get_meta(slab)->sizeclass() == sizeclass,
"Heap Corruption: Sizeclass of remote dealloc corrupt.");
small_dealloc_offseted(
super, slab, FreeObject::make(p_offseted), sizeclass);
}
else
{
SNMALLOC_ASSERT(super->get_kind() == Medium);
auto medium = super.template as_reinterpret<Mediumslab>();
SNMALLOC_ASSERT(medium->get_kind() == Medium);
check_client(
medium->get_kind() == Medium,
"Heap Corruption: Sizeclass of remote dealloc corrupt.");
check_client(
medium->get_sizeclass() == sizeclass,
"Heap Corruption: Sizeclass of remote dealloc corrupt.");
medium_dealloc_local(
super.template as_reinterpret<Mediumslab>(),
Remote::clear(p_offseted, sizeclass),
sizeclass);
medium, Remote::clear(p_offseted, sizeclass), sizeclass);
}
}