libsanitizer/asan/asan_malloc_win.cc

   1 //===-- asan_malloc_win.cc ------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // Windows-specific malloc interception.
  11 //===----------------------------------------------------------------------===//
  12
  13 #include "sanitizer_common/sanitizer_platform.h"
  14 #if SANITIZER_WINDOWS
  15 #define WIN32_LEAN_AND_MEAN
  16 #include <windows.h>
  17
  18 #include "asan_allocator.h"
  19 #include "asan_interceptors.h"
  20 #include "asan_internal.h"
  21 #include "asan_stack.h"
  22 #include "interception/interception.h"
  23
  24 #include <stddef.h>
  25
  26 using namespace __asan;  // NOLINT
  27
  28 // MT: Simply defining functions with the same signature in *.obj
  29 // files overrides the standard functions in the CRT.
  30 // MD: Memory allocation functions are defined in the CRT .dll,
  31 // so we have to intercept them before they are called for the first time.
  32
  33 #if ASAN_DYNAMIC
  34 # define ALLOCATION_FUNCTION_ATTRIBUTE
  35 #else
  36 # define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
  37 #endif
  38
  39 extern "C" {
  40 ALLOCATION_FUNCTION_ATTRIBUTE
  41 void free(void *ptr) {
  42   GET_STACK_TRACE_FREE;
  43   return asan_free(ptr, &stack, FROM_MALLOC);
  44 }
  45
  46 ALLOCATION_FUNCTION_ATTRIBUTE
  47 void _free_dbg(void *ptr, int) {
  48   free(ptr);
  49 }
  50
  51 ALLOCATION_FUNCTION_ATTRIBUTE
  52 void _free_base(void *ptr) {
  53   free(ptr);
  54 }
  55
  56 ALLOCATION_FUNCTION_ATTRIBUTE
  57 void *malloc(size_t size) {
  58   GET_STACK_TRACE_MALLOC;
  59   return asan_malloc(size, &stack);
  60 }
  61
  62 ALLOCATION_FUNCTION_ATTRIBUTE
  63 void *_malloc_base(size_t size) {
  64   return malloc(size);
  65 }
  66
  67 ALLOCATION_FUNCTION_ATTRIBUTE
  68 void *_malloc_dbg(size_t size, int, const char *, int) {
  69   return malloc(size);
  70 }
  71
  72 ALLOCATION_FUNCTION_ATTRIBUTE
  73 void *calloc(size_t nmemb, size_t size) {
  74   GET_STACK_TRACE_MALLOC;
  75   return asan_calloc(nmemb, size, &stack);
  76 }
  77
  78 ALLOCATION_FUNCTION_ATTRIBUTE
  79 void *_calloc_base(size_t nmemb, size_t size) {
  80   return calloc(nmemb, size);
  81 }
  82
  83 ALLOCATION_FUNCTION_ATTRIBUTE
  84 void *_calloc_dbg(size_t nmemb, size_t size, int, const char *, int) {
  85   return calloc(nmemb, size);
  86 }
  87
  88 ALLOCATION_FUNCTION_ATTRIBUTE
  89 void *_calloc_impl(size_t nmemb, size_t size, int *errno_tmp) {
  90   return calloc(nmemb, size);
  91 }
  92
  93 ALLOCATION_FUNCTION_ATTRIBUTE
  94 void *realloc(void *ptr, size_t size) {
  95   GET_STACK_TRACE_MALLOC;
  96   return asan_realloc(ptr, size, &stack);
  97 }
  98
  99 ALLOCATION_FUNCTION_ATTRIBUTE
 100 void *_realloc_dbg(void *ptr, size_t size, int) {
 101   UNREACHABLE("_realloc_dbg should not exist!");
 102   return 0;
 103 }
 104
 105 ALLOCATION_FUNCTION_ATTRIBUTE
 106 void *_realloc_base(void *ptr, size_t size) {
 107   return realloc(ptr, size);
 108 }
 109
 110 ALLOCATION_FUNCTION_ATTRIBUTE
 111 void *_recalloc(void *p, size_t n, size_t elem_size) {
 112   if (!p)
 113     return calloc(n, elem_size);
 114   const size_t size = n * elem_size;
 115   if (elem_size != 0 && size / elem_size != n)
 116     return 0;
 117   return realloc(p, size);
 118 }
 119
 120 ALLOCATION_FUNCTION_ATTRIBUTE
 121 void *_recalloc_base(void *p, size_t n, size_t elem_size) {
 122   return _recalloc(p, n, elem_size);
 123 }
 124
 125 ALLOCATION_FUNCTION_ATTRIBUTE
 126 size_t _msize(const void *ptr) {
 127   GET_CURRENT_PC_BP_SP;
 128   (void)sp;
 129   return asan_malloc_usable_size(ptr, pc, bp);
 130 }
 131
 132 ALLOCATION_FUNCTION_ATTRIBUTE
 133 void *_expand(void *memblock, size_t size) {
 134   // _expand is used in realloc-like functions to resize the buffer if possible.
 135   // We don't want memory to stand still while resizing buffers, so return 0.
 136   return 0;
 137 }
 138
 139 ALLOCATION_FUNCTION_ATTRIBUTE
 140 void *_expand_dbg(void *memblock, size_t size) {
 141   return _expand(memblock, size);
 142 }
 143
 144 // TODO(timurrrr): Might want to add support for _aligned_* allocation
 145 // functions to detect a bit more bugs.  Those functions seem to wrap malloc().
 146
 147 int _CrtDbgReport(int, const char*, int,
 148                   const char*, const char*, ...) {
 149   ShowStatsAndAbort();
 150 }
 151
 152 int _CrtDbgReportW(int reportType, const wchar_t*, int,
 153                    const wchar_t*, const wchar_t*, ...) {
 154   ShowStatsAndAbort();
 155 }
 156
 157 int _CrtSetReportMode(int, int) {
 158   return 0;
 159 }
 160 }  // extern "C"
 161
 162 INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags,
 163                    SIZE_T dwBytes) {
 164   GET_STACK_TRACE_MALLOC;
 165   void *p = asan_malloc(dwBytes, &stack);
 166   // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
 167   // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
 168   // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
 169   if (dwFlags == HEAP_ZERO_MEMORY)
 170     internal_memset(p, 0, asan_mz_size(p));
 171   else
 172     CHECK(dwFlags == 0 && "unsupported heap flags");
 173   return p;
 174 }
 175
 176 INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) {
 177   CHECK(dwFlags == 0 && "unsupported heap flags");
 178   GET_STACK_TRACE_FREE;
 179   asan_free(lpMem, &stack, FROM_MALLOC);
 180   return true;
 181 }
 182
 183 INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags,
 184                    LPVOID lpMem, SIZE_T dwBytes) {
 185   GET_STACK_TRACE_MALLOC;
 186   // Realloc should never reallocate in place.
 187   if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY)
 188     return nullptr;
 189   CHECK(dwFlags == 0 && "unsupported heap flags");
 190   return asan_realloc(lpMem, dwBytes, &stack);
 191 }
 192
 193 INTERCEPTOR_WINAPI(SIZE_T, HeapSize, HANDLE hHeap, DWORD dwFlags,
 194                    LPCVOID lpMem) {
 195   CHECK(dwFlags == 0 && "unsupported heap flags");
 196   GET_CURRENT_PC_BP_SP;
 197   (void)sp;
 198   return asan_malloc_usable_size(lpMem, pc, bp);
 199 }
 200
 201 namespace __asan {
 202
 203 static void TryToOverrideFunction(const char *fname, uptr new_func) {
 204   // Failure here is not fatal. The CRT may not be present, and different CRT
 205   // versions use different symbols.
 206   if (!__interception::OverrideFunction(fname, new_func))
 207     VPrintf(2, "Failed to override function %s\n", fname);
 208 }
 209
 210 void ReplaceSystemMalloc() {
 211 #if defined(ASAN_DYNAMIC)
 212   TryToOverrideFunction("free", (uptr)free);
 213   TryToOverrideFunction("_free_base", (uptr)free);
 214   TryToOverrideFunction("malloc", (uptr)malloc);
 215   TryToOverrideFunction("_malloc_base", (uptr)malloc);
 216   TryToOverrideFunction("_malloc_crt", (uptr)malloc);
 217   TryToOverrideFunction("calloc", (uptr)calloc);
 218   TryToOverrideFunction("_calloc_base", (uptr)calloc);
 219   TryToOverrideFunction("_calloc_crt", (uptr)calloc);
 220   TryToOverrideFunction("realloc", (uptr)realloc);
 221   TryToOverrideFunction("_realloc_base", (uptr)realloc);
 222   TryToOverrideFunction("_realloc_crt", (uptr)realloc);
 223   TryToOverrideFunction("_recalloc", (uptr)_recalloc);
 224   TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);
 225   TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);
 226   TryToOverrideFunction("_msize", (uptr)_msize);
 227   TryToOverrideFunction("_expand", (uptr)_expand);
 228   TryToOverrideFunction("_expand_base", (uptr)_expand);
 229
 230   // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which
 231   // enable cross-module inlining. This means our _malloc_base hook won't catch
 232   // all CRT allocations. This code here patches the import table of
 233   // ucrtbase.dll so that all attempts to use the lower-level win32 heap
 234   // allocation API will be directed to ASan's heap. We don't currently
 235   // intercept all calls to HeapAlloc. If we did, we would have to check on
 236   // HeapFree whether the pointer came from ASan of from the system.
 237 #define INTERCEPT_UCRT_FUNCTION(func)                                         \
 238   if (!INTERCEPT_FUNCTION_DLLIMPORT("ucrtbase.dll",                           \
 239                                     "api-ms-win-core-heap-l1-1-0.dll", func)) \
 240     VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func);
 241   INTERCEPT_UCRT_FUNCTION(HeapAlloc);
 242   INTERCEPT_UCRT_FUNCTION(HeapFree);
 243   INTERCEPT_UCRT_FUNCTION(HeapReAlloc);
 244   INTERCEPT_UCRT_FUNCTION(HeapSize);
 245 #undef INTERCEPT_UCRT_FUNCTION
 246 #endif
 247 }
 248 }  // namespace __asan
 249
 250 #endif  // _WIN32