Home | History | Annotate | Download | only in tests
      1 #include <unistd.h>
      2 #include "tests/sys_mman.h"
      3 #include <assert.h>
      4 #include <stdlib.h>
      5 
      6 #include "../memcheck.h"
      7 
      8 #define SUPERBLOCK_SIZE    100000
      9 
     10 //-------------------------------------------------------------------------
     11 // Allocator
     12 //-------------------------------------------------------------------------
     13 
     14 void* get_superblock(void)
     15 {
     16    void* p = mmap( 0, SUPERBLOCK_SIZE, PROT_READ|PROT_WRITE|PROT_EXEC,
     17                    MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 );
     18 
     19    assert(p != ((void*)(-1)));
     20 
     21    // Mark it no access;  although it's addressible we don't want the
     22    // program to be using it unless its handed out by custom_alloc()
     23 
     24    // with redzones, better not to have it
     25    VALGRIND_MAKE_MEM_NOACCESS(p, SUPERBLOCK_SIZE);
     26 
     27    return p;
     28 }
     29 
     30 // has a redzone
     31 static void* custom_alloc(int size)
     32 {
     33 #define RZ  8
     34    static void* hp     = 0;    // current heap pointer
     35    static void* hp_lim = 0;    // maximum usable byte in current block
     36    int          size2  = size + RZ*2;
     37    void*        p;
     38 
     39    if (hp + size2 > hp_lim) {
     40       hp = get_superblock();
     41       hp_lim = hp + SUPERBLOCK_SIZE - 1;
     42    }
     43 
     44    p = hp + RZ;
     45    hp += size2;
     46 
     47    VALGRIND_MALLOCLIKE_BLOCK( p, size, RZ, /*is_zeroed*/1 );
     48    return (void*)p;
     49 }
     50 
     51 static void custom_free(void* p)
     52 {
     53    // don't actually free any memory... but mark it as freed
     54    VALGRIND_FREELIKE_BLOCK( p, RZ );
     55 }
     56 
     57 static void checkredzone(void)
     58 {
     59    /* check that accessing the redzone of a MALLOCLIKE block
     60       is detected  when the superblock was not marked as no access. */
     61    char superblock[1 + RZ + 20 + RZ + 1];
     62    char *p = 1 + RZ + superblock;
     63    assert(RZ > 0);
     64 
     65    // Indicate we have allocated p from our superblock:
     66    VALGRIND_MALLOCLIKE_BLOCK( p, 20, RZ, /*is_zeroed*/1 );
     67    p[0] = 0;
     68    p[-1] = p[0]; // error expected
     69    p[-RZ] = p[0]; // error expected
     70    p[-RZ-1] = p[0]; // no error expected
     71 
     72    p[19] = 0;
     73    p[19 + 1]  = p[0]; // error expected
     74    p[19 + RZ] = p[0]; // error expected
     75    p[19 + RZ + 1] = p[0]; // no error expected
     76 
     77    VALGRIND_FREELIKE_BLOCK( p, RZ );
     78 
     79    // Now, indicate we have re-allocated p from our superblock
     80    // but with only a size 10.
     81    VALGRIND_MALLOCLIKE_BLOCK( p, 10, RZ, /*is_zeroed*/1 );
     82    p[0] = 0;
     83    p[-1] = p[0]; // error expected
     84    p[-RZ] = p[0]; // error expected
     85    p[-RZ-1] = p[0]; // no error expected
     86 
     87    p[9] = 0;
     88    p[9 + 1]  = p[0]; // error expected
     89    p[9 + RZ] = p[0]; // error expected
     90    p[9 + RZ + 1] = p[0]; // no error expected
     91 
     92    VALGRIND_FREELIKE_BLOCK( p, RZ );
     93 
     94 }
     95 
     96 
     97 
     98 //-------------------------------------------------------------------------
     99 // Rest
    100 //-------------------------------------------------------------------------
    101 
    102 void make_leak(void)
    103 {
    104    int* array2 __attribute__((unused)) = custom_alloc(sizeof(int) * 10);
    105    array2 = 0;          // leak
    106    return;
    107 }
    108 
    109 int main(void)
    110 {
    111    int *array, *array3;
    112    int x;
    113 
    114    array = custom_alloc(sizeof(int) * 10);
    115    array[8]  = 8;
    116    array[9]  = 8;
    117    array[10] = 10;      // invalid write (ok w/o MALLOCLIKE -- in superblock)
    118 
    119    VALGRIND_RESIZEINPLACE_BLOCK(array, sizeof(int) * 10, sizeof(int) * 5, RZ);
    120    array[4] = 7;
    121    array[5] = 9; // invalid write
    122 
    123    // Make the entire array defined again such that it can be verified whether
    124    // the red zone is marked properly when resizing in place.
    125    VALGRIND_MAKE_MEM_DEFINED(array, sizeof(int) * 10);
    126 
    127    VALGRIND_RESIZEINPLACE_BLOCK(array, sizeof(int) * 5, sizeof(int) * 7, RZ);
    128    if (array[5]) array[4]++; // uninitialized read of array[5]
    129    array[5]  = 11;
    130    array[6]  = 7;
    131    array[7] = 8; // invalid write
    132 
    133    // invalid realloc
    134    VALGRIND_RESIZEINPLACE_BLOCK(array+1, sizeof(int) * 7, sizeof(int) * 8, RZ);
    135 
    136    custom_free(array);  // ok
    137 
    138    custom_free((void*)0x1);  // invalid free
    139 
    140    array3 = malloc(sizeof(int) * 10);
    141    custom_free(array3); // mismatched free (ok without MALLOCLIKE)
    142 
    143    make_leak();
    144    x = array[0];        // use after free (ok without MALLOCLIKE/MAKE_MEM_NOACCESS)
    145 
    146    // Bug 137073: passing 0 to MALLOCLIKE_BLOCK was causing an assertion
    147    // failure.  Test for this (and likewise for FREELIKE_BLOCK).
    148    VALGRIND_MALLOCLIKE_BLOCK(0,0,0,0);
    149    VALGRIND_FREELIKE_BLOCK(0,0);
    150 
    151    checkredzone();
    152 
    153    return x;
    154 
    155    // leak from make_leak()
    156 }
    157 
    158 #undef RZ
    159