From 118eecb2e6bd8f7795cd7f2bc1ce66dc591e58e9 Mon Sep 17 00:00:00 2001 From: Matthew Parkinson Date: Thu, 8 Apr 2021 15:50:34 +0100 Subject: [PATCH] Check for heap corruption The allocator id and sizeclass are stored in deallocated objects to provide quick lookup. This adds checks that these are actually correct. --- src/mem/alloc.h | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/src/mem/alloc.h b/src/mem/alloc.h index ee6ff63..ac42605 100644 --- a/src/mem/alloc.h +++ b/src/mem/alloc.h @@ -916,18 +916,29 @@ namespace snmalloc if (likely(sizeclass < NUM_SMALL_CLASSES)) { SNMALLOC_ASSERT(super->get_kind() == Super); + check_client( + super->get_kind() == Super, + "Heap Corruption: Sizeclass of remote dealloc corrupt."); auto slab = Metaslab::get_slab(Aal::capptr_rebound(super.as_void(), p_offseted)); + check_client( + super->get_meta(slab)->sizeclass() == sizeclass, + "Heap Corruption: Sizeclass of remote dealloc corrupt."); small_dealloc_offseted( super, slab, FreeObject::make(p_offseted), sizeclass); } else { - SNMALLOC_ASSERT(super->get_kind() == Medium); + auto medium = super.template as_reinterpret(); + SNMALLOC_ASSERT(medium->get_kind() == Medium); + check_client( + medium->get_kind() == Medium, + "Heap Corruption: Sizeclass of remote dealloc corrupt."); + check_client( + medium->get_sizeclass() == sizeclass, + "Heap Corruption: Sizeclass of remote dealloc corrupt."); medium_dealloc_local( - super.template as_reinterpret(), - Remote::clear(p_offseted, sizeclass), - sizeclass); + medium, Remote::clear(p_offseted, sizeclass), sizeclass); } }