Harden sizeclass table

If a sizeclass in the metadata is corrupted, then this can be used to
force an index beyond the end of these tables. This extends the tables
to the next power of two, and uses a mask on the index, so they are
always either a valid piece of data, or zero.
This commit is contained in:
Matthew Parkinson
2019-01-21 17:44:09 +00:00
parent 94f8b886a0
commit bb5027b454
2 changed files with 27 additions and 6 deletions

View File

@@ -1,5 +1,6 @@
#pragma once
#include "bits.h"
#include "flaglock.h"
namespace snmalloc
@@ -30,4 +31,22 @@ namespace snmalloc
return obj;
}
};
template <size_t length, typename T>
class ModArray
{
static constexpr size_t rlength = bits::next_pow2_const(length);
T array[rlength];
public:
constexpr const T &operator[] (const size_t i) const
{
return array[i & (rlength - 1)];
}
constexpr T &operator[] (const size_t i)
{
return array[i & (rlength - 1)];
}
};
}

View File

@@ -1,16 +1,17 @@
#pragma once
#include "superslab.h"
#include "../ds/helpers.h"
namespace snmalloc
{
struct SizeClassTable
{
size_t size[NUM_SIZECLASSES];
uint16_t bump_ptr_start[NUM_SMALL_CLASSES];
uint16_t short_bump_ptr_start[NUM_SMALL_CLASSES];
uint16_t count_per_slab[NUM_SMALL_CLASSES];
uint16_t medium_slab_slots[NUM_MEDIUM_CLASSES];
ModArray<NUM_SIZECLASSES, size_t> size;
ModArray<NUM_SMALL_CLASSES, uint16_t> bump_ptr_start;
ModArray<NUM_SMALL_CLASSES, uint16_t> short_bump_ptr_start;
ModArray<NUM_SMALL_CLASSES, uint16_t> count_per_slab;
ModArray<NUM_MEDIUM_CLASSES, uint16_t> medium_slab_slots;
constexpr SizeClassTable()
: size(),
@@ -66,6 +67,7 @@ namespace snmalloc
constexpr static inline uint16_t medium_slab_free(uint8_t sizeclass)
{
return sizeclass_metadata.medium_slab_slots[sizeclass - NUM_SMALL_CLASSES];
return sizeclass_metadata.medium_slab_slots
[(sizeclass - NUM_SMALL_CLASSES)];
}
}