libsanitizer/asan/asan_malloc_win.cpp

   1 //===-- asan_malloc_win.cpp -----------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This file is a part of AddressSanitizer, an address sanity checker.
  10 //
  11 // Windows-specific malloc interception.
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "sanitizer_common/sanitizer_allocator_interface.h"
  15 #include "sanitizer_common/sanitizer_platform.h"
  16 #if SANITIZER_WINDOWS
  17 #include "asan_allocator.h"
  18 #include "asan_interceptors.h"
  19 #include "asan_internal.h"
  20 #include "asan_stack.h"
  21 #include "interception/interception.h"
  22 #include <stddef.h>
  23
  24 // Intentionally not including windows.h here, to avoid the risk of
  25 // pulling in conflicting declarations of these functions. (With mingw-w64,
  26 // there's a risk of windows.h pulling in stdint.h.)
  27 typedef int BOOL;
  28 typedef void *HANDLE;
  29 typedef const void *LPCVOID;
  30 typedef void *LPVOID;
  31
  32 typedef unsigned long DWORD;
  33 constexpr unsigned long HEAP_ZERO_MEMORY = 0x00000008;
  34 constexpr unsigned long HEAP_REALLOC_IN_PLACE_ONLY = 0x00000010;
  35 constexpr unsigned long HEAP_ALLOCATE_SUPPORTED_FLAGS = (HEAP_ZERO_MEMORY);
  36 constexpr unsigned long HEAP_ALLOCATE_UNSUPPORTED_FLAGS =
  37     (~HEAP_ALLOCATE_SUPPORTED_FLAGS);
  38 constexpr unsigned long HEAP_FREE_UNSUPPORTED_FLAGS =
  39     (~HEAP_ALLOCATE_SUPPORTED_FLAGS);
  40 constexpr unsigned long HEAP_REALLOC_UNSUPPORTED_FLAGS =
  41     (~HEAP_ALLOCATE_SUPPORTED_FLAGS);
  42
  43
  44 extern "C" {
  45 LPVOID WINAPI HeapAlloc(HANDLE hHeap, DWORD dwFlags, size_t dwBytes);
  46 LPVOID WINAPI HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem,
  47                          size_t dwBytes);
  48 BOOL WINAPI HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
  49 size_t WINAPI HeapSize(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem);
  50
  51 BOOL WINAPI HeapValidate(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem);
  52 }
  53
  54 using namespace __asan;
  55
  56 // MT: Simply defining functions with the same signature in *.obj
  57 // files overrides the standard functions in the CRT.
  58 // MD: Memory allocation functions are defined in the CRT .dll,
  59 // so we have to intercept them before they are called for the first time.
  60
  61 #if ASAN_DYNAMIC
  62 # define ALLOCATION_FUNCTION_ATTRIBUTE
  63 #else
  64 # define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
  65 #endif
  66
  67 extern "C" {
  68 ALLOCATION_FUNCTION_ATTRIBUTE
  69 size_t _msize(void *ptr) {
  70   GET_CURRENT_PC_BP_SP;
  71   (void)sp;
  72   return asan_malloc_usable_size(ptr, pc, bp);
  73 }
  74
  75 ALLOCATION_FUNCTION_ATTRIBUTE
  76 size_t _msize_base(void *ptr) {
  77   return _msize(ptr);
  78 }
  79
  80 ALLOCATION_FUNCTION_ATTRIBUTE
  81 void free(void *ptr) {
  82   GET_STACK_TRACE_FREE;
  83   return asan_free(ptr, &stack, FROM_MALLOC);
  84 }
  85
  86 ALLOCATION_FUNCTION_ATTRIBUTE
  87 void _free_dbg(void *ptr, int) {
  88   free(ptr);
  89 }
  90
  91 ALLOCATION_FUNCTION_ATTRIBUTE
  92 void _free_base(void *ptr) {
  93   free(ptr);
  94 }
  95
  96 ALLOCATION_FUNCTION_ATTRIBUTE
  97 void *malloc(size_t size) {
  98   GET_STACK_TRACE_MALLOC;
  99   return asan_malloc(size, &stack);
 100 }
 101
 102 ALLOCATION_FUNCTION_ATTRIBUTE
 103 void *_malloc_base(size_t size) {
 104   return malloc(size);
 105 }
 106
 107 ALLOCATION_FUNCTION_ATTRIBUTE
 108 void *_malloc_dbg(size_t size, int, const char *, int) {
 109   return malloc(size);
 110 }
 111
 112 ALLOCATION_FUNCTION_ATTRIBUTE
 113 void *calloc(size_t nmemb, size_t size) {
 114   GET_STACK_TRACE_MALLOC;
 115   return asan_calloc(nmemb, size, &stack);
 116 }
 117
 118 ALLOCATION_FUNCTION_ATTRIBUTE
 119 void *_calloc_base(size_t nmemb, size_t size) {
 120   return calloc(nmemb, size);
 121 }
 122
 123 ALLOCATION_FUNCTION_ATTRIBUTE
 124 void *_calloc_dbg(size_t nmemb, size_t size, int, const char *, int) {
 125   return calloc(nmemb, size);
 126 }
 127
 128 ALLOCATION_FUNCTION_ATTRIBUTE
 129 void *_calloc_impl(size_t nmemb, size_t size, int *errno_tmp) {
 130   return calloc(nmemb, size);
 131 }
 132
 133 ALLOCATION_FUNCTION_ATTRIBUTE
 134 void *realloc(void *ptr, size_t size) {
 135   GET_STACK_TRACE_MALLOC;
 136   return asan_realloc(ptr, size, &stack);
 137 }
 138
 139 ALLOCATION_FUNCTION_ATTRIBUTE
 140 void *_realloc_dbg(void *ptr, size_t size, int) {
 141   UNREACHABLE("_realloc_dbg should not exist!");
 142   return 0;
 143 }
 144
 145 ALLOCATION_FUNCTION_ATTRIBUTE
 146 void *_realloc_base(void *ptr, size_t size) {
 147   return realloc(ptr, size);
 148 }
 149
 150 ALLOCATION_FUNCTION_ATTRIBUTE
 151 void *_recalloc(void *p, size_t n, size_t elem_size) {
 152   if (!p)
 153     return calloc(n, elem_size);
 154   const size_t size = n * elem_size;
 155   if (elem_size != 0 && size / elem_size != n)
 156     return 0;
 157
 158   size_t old_size = _msize(p);
 159   void *new_alloc = malloc(size);
 160   if (new_alloc) {
 161     REAL(memcpy)(new_alloc, p, Min<size_t>(size, old_size));
 162     if (old_size < size)
 163       REAL(memset)(((u8 *)new_alloc) + old_size, 0, size - old_size);
 164     free(p);
 165   }
 166   return new_alloc;
 167 }
 168
 169 ALLOCATION_FUNCTION_ATTRIBUTE
 170 void *_recalloc_base(void *p, size_t n, size_t elem_size) {
 171   return _recalloc(p, n, elem_size);
 172 }
 173
 174 ALLOCATION_FUNCTION_ATTRIBUTE
 175 void *_expand(void *memblock, size_t size) {
 176   // _expand is used in realloc-like functions to resize the buffer if possible.
 177   // We don't want memory to stand still while resizing buffers, so return 0.
 178   return 0;
 179 }
 180
 181 ALLOCATION_FUNCTION_ATTRIBUTE
 182 void *_expand_dbg(void *memblock, size_t size) {
 183   return _expand(memblock, size);
 184 }
 185
 186 // TODO(timurrrr): Might want to add support for _aligned_* allocation
 187 // functions to detect a bit more bugs.  Those functions seem to wrap malloc().
 188
 189 int _CrtDbgReport(int, const char*, int,
 190                   const char*, const char*, ...) {
 191   ShowStatsAndAbort();
 192 }
 193
 194 int _CrtDbgReportW(int reportType, const wchar_t*, int,
 195                    const wchar_t*, const wchar_t*, ...) {
 196   ShowStatsAndAbort();
 197 }
 198
 199 int _CrtSetReportMode(int, int) {
 200   return 0;
 201 }
 202 }  // extern "C"
 203
 204 #define OWNED_BY_RTL(heap, memory) \
 205   (!__sanitizer_get_ownership(memory) && HeapValidate(heap, 0, memory))
 206
 207 INTERCEPTOR_WINAPI(size_t, HeapSize, HANDLE hHeap, DWORD dwFlags,
 208                    LPCVOID lpMem) {
 209   // If the RTL allocators are hooked we need to check whether the ASAN
 210   // allocator owns the pointer we're about to use. Allocations occur before
 211   // interception takes place, so if it is not owned by the RTL heap we can
 212   // pass it to the ASAN heap for inspection.
 213   if (flags()->windows_hook_rtl_allocators) {
 214     if (!asan_inited || OWNED_BY_RTL(hHeap, lpMem))
 215       return REAL(HeapSize)(hHeap, dwFlags, lpMem);
 216   } else {
 217     CHECK(dwFlags == 0 && "unsupported heap flags");
 218   }
 219   GET_CURRENT_PC_BP_SP;
 220   (void)sp;
 221   return asan_malloc_usable_size(lpMem, pc, bp);
 222 }
 223
 224 INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags,
 225                    size_t dwBytes) {
 226   // If the ASAN runtime is not initialized, or we encounter an unsupported
 227   // flag, fall back to the original allocator.
 228   if (flags()->windows_hook_rtl_allocators) {
 229     if (UNLIKELY(!asan_inited ||
 230                  (dwFlags & HEAP_ALLOCATE_UNSUPPORTED_FLAGS) != 0)) {
 231       return REAL(HeapAlloc)(hHeap, dwFlags, dwBytes);
 232     }
 233   } else {
 234     // In the case that we don't hook the rtl allocators,
 235     // this becomes an assert since there is no failover to the original
 236     // allocator.
 237     CHECK((HEAP_ALLOCATE_UNSUPPORTED_FLAGS & dwFlags) != 0 &&
 238           "unsupported flags");
 239   }
 240   GET_STACK_TRACE_MALLOC;
 241   void *p = asan_malloc(dwBytes, &stack);
 242   // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
 243   // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
 244   // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
 245   if (p && (dwFlags & HEAP_ZERO_MEMORY)) {
 246     GET_CURRENT_PC_BP_SP;
 247     (void)sp;
 248     auto usable_size = asan_malloc_usable_size(p, pc, bp);
 249     internal_memset(p, 0, usable_size);
 250   }
 251   return p;
 252 }
 253
 254 INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) {
 255   // Heap allocations happen before this function is hooked, so we must fall
 256   // back to the original function if the pointer is not from the ASAN heap,
 257   // or unsupported flags are provided.
 258   if (flags()->windows_hook_rtl_allocators) {
 259     if (OWNED_BY_RTL(hHeap, lpMem))
 260       return REAL(HeapFree)(hHeap, dwFlags, lpMem);
 261   } else {
 262     CHECK((HEAP_FREE_UNSUPPORTED_FLAGS & dwFlags) != 0 && "unsupported flags");
 263   }
 264   GET_STACK_TRACE_FREE;
 265   asan_free(lpMem, &stack, FROM_MALLOC);
 266   return true;
 267 }
 268
 269 namespace __asan {
 270 using AllocFunction = LPVOID(WINAPI *)(HANDLE, DWORD, size_t);
 271 using ReAllocFunction = LPVOID(WINAPI *)(HANDLE, DWORD, LPVOID, size_t);
 272 using SizeFunction = size_t(WINAPI *)(HANDLE, DWORD, LPVOID);
 273 using FreeFunction = BOOL(WINAPI *)(HANDLE, DWORD, LPVOID);
 274
 275 void *SharedReAlloc(ReAllocFunction reallocFunc, SizeFunction heapSizeFunc,
 276                     FreeFunction freeFunc, AllocFunction allocFunc,
 277                     HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, size_t dwBytes) {
 278   CHECK(reallocFunc && heapSizeFunc && freeFunc && allocFunc);
 279   GET_STACK_TRACE_MALLOC;
 280   GET_CURRENT_PC_BP_SP;
 281   (void)sp;
 282   if (flags()->windows_hook_rtl_allocators) {
 283     enum AllocationOwnership { NEITHER = 0, ASAN = 1, RTL = 2 };
 284     AllocationOwnership ownershipState;
 285     bool owned_rtlalloc = false;
 286     bool owned_asan = __sanitizer_get_ownership(lpMem);
 287
 288     if (!owned_asan)
 289       owned_rtlalloc = HeapValidate(hHeap, 0, lpMem);
 290
 291     if (owned_asan && !owned_rtlalloc)
 292       ownershipState = ASAN;
 293     else if (!owned_asan && owned_rtlalloc)
 294       ownershipState = RTL;
 295     else if (!owned_asan && !owned_rtlalloc)
 296       ownershipState = NEITHER;
 297
 298     // If this heap block which was allocated before the ASAN
 299     // runtime came up, use the real HeapFree function.
 300     if (UNLIKELY(!asan_inited)) {
 301       return reallocFunc(hHeap, dwFlags, lpMem, dwBytes);
 302     }
 303     bool only_asan_supported_flags =
 304         (HEAP_REALLOC_UNSUPPORTED_FLAGS & dwFlags) == 0;
 305
 306     if (ownershipState == RTL ||
 307         (ownershipState == NEITHER && !only_asan_supported_flags)) {
 308       if (only_asan_supported_flags) {
 309         // if this is a conversion to ASAN upported flags, transfer this
 310         // allocation to the ASAN allocator
 311         void *replacement_alloc;
 312         if (dwFlags & HEAP_ZERO_MEMORY)
 313           replacement_alloc = asan_calloc(1, dwBytes, &stack);
 314         else
 315           replacement_alloc = asan_malloc(dwBytes, &stack);
 316         if (replacement_alloc) {
 317           size_t old_size = heapSizeFunc(hHeap, dwFlags, lpMem);
 318           if (old_size == ((size_t)0) - 1) {
 319             asan_free(replacement_alloc, &stack, FROM_MALLOC);
 320             return nullptr;
 321           }
 322           REAL(memcpy)(replacement_alloc, lpMem, old_size);
 323           freeFunc(hHeap, dwFlags, lpMem);
 324         }
 325         return replacement_alloc;
 326       } else {
 327         // owned by rtl or neither with unsupported ASAN flags,
 328         // just pass back to original allocator
 329         CHECK(ownershipState == RTL || ownershipState == NEITHER);
 330         CHECK(!only_asan_supported_flags);
 331         return reallocFunc(hHeap, dwFlags, lpMem, dwBytes);
 332       }
 333     }
 334
 335     if (ownershipState == ASAN && !only_asan_supported_flags) {
 336       // Conversion to unsupported flags allocation,
 337       // transfer this allocation back to the original allocator.
 338       void *replacement_alloc = allocFunc(hHeap, dwFlags, dwBytes);
 339       size_t old_usable_size = 0;
 340       if (replacement_alloc) {
 341         old_usable_size = asan_malloc_usable_size(lpMem, pc, bp);
 342         REAL(memcpy)(replacement_alloc, lpMem,
 343                      Min<size_t>(dwBytes, old_usable_size));
 344         asan_free(lpMem, &stack, FROM_MALLOC);
 345       }
 346       return replacement_alloc;
 347     }
 348
 349     CHECK((ownershipState == ASAN || ownershipState == NEITHER) &&
 350           only_asan_supported_flags);
 351     // At this point we should either be ASAN owned with ASAN supported flags
 352     // or we owned by neither and have supported flags.
 353     // Pass through even when it's neither since this could be a null realloc or
 354     // UAF that ASAN needs to catch.
 355   } else {
 356     CHECK((HEAP_REALLOC_UNSUPPORTED_FLAGS & dwFlags) != 0 &&
 357           "unsupported flags");
 358   }
 359   // asan_realloc will never reallocate in place, so for now this flag is
 360   // unsupported until we figure out a way to fake this.
 361   if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY)
 362     return nullptr;
 363
 364   // HeapReAlloc and HeapAlloc both happily accept 0 sized allocations.
 365   // passing a 0 size into asan_realloc will free the allocation.
 366   // To avoid this and keep behavior consistent, fudge the size if 0.
 367   // (asan_malloc already does this)
 368   if (dwBytes == 0)
 369     dwBytes = 1;
 370
 371   size_t old_size;
 372   if (dwFlags & HEAP_ZERO_MEMORY)
 373     old_size = asan_malloc_usable_size(lpMem, pc, bp);
 374
 375   void *ptr = asan_realloc(lpMem, dwBytes, &stack);
 376   if (ptr == nullptr)
 377     return nullptr;
 378
 379   if (dwFlags & HEAP_ZERO_MEMORY) {
 380     size_t new_size = asan_malloc_usable_size(ptr, pc, bp);
 381     if (old_size < new_size)
 382       REAL(memset)(((u8 *)ptr) + old_size, 0, new_size - old_size);
 383   }
 384
 385   return ptr;
 386 }
 387 }  // namespace __asan
 388
 389 INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags,
 390                    LPVOID lpMem, size_t dwBytes) {
 391   return SharedReAlloc(REAL(HeapReAlloc), (SizeFunction)REAL(HeapSize),
 392                        REAL(HeapFree), REAL(HeapAlloc), hHeap, dwFlags, lpMem,
 393                        dwBytes);
 394 }
 395
 396 // The following functions are undocumented and subject to change.
 397 // However, hooking them is necessary to hook Windows heap
 398 // allocations with detours and their definitions are unlikely to change.
 399 // Comments in /minkernel/ntos/rtl/heappublic.c indicate that these functions
 400 // are part of the heap's public interface.
 401 typedef unsigned long LOGICAL;
 402
 403 // This function is documented as part of the Driver Development Kit but *not*
 404 // the Windows Development Kit.
 405 LOGICAL RtlFreeHeap(void* HeapHandle, DWORD Flags,
 406                             void* BaseAddress);
 407
 408 // This function is documented as part of the Driver Development Kit but *not*
 409 // the Windows Development Kit.
 410 void* RtlAllocateHeap(void* HeapHandle, DWORD Flags, size_t Size);
 411
 412 // This function is completely undocumented.
 413 void*
 414 RtlReAllocateHeap(void* HeapHandle, DWORD Flags, void* BaseAddress,
 415                   size_t Size);
 416
 417 // This function is completely undocumented.
 418 size_t RtlSizeHeap(void* HeapHandle, DWORD Flags, void* BaseAddress);
 419
 420 INTERCEPTOR_WINAPI(size_t, RtlSizeHeap, HANDLE HeapHandle, DWORD Flags,
 421                    void* BaseAddress) {
 422   if (!flags()->windows_hook_rtl_allocators ||
 423       UNLIKELY(!asan_inited || OWNED_BY_RTL(HeapHandle, BaseAddress))) {
 424     return REAL(RtlSizeHeap)(HeapHandle, Flags, BaseAddress);
 425   }
 426   GET_CURRENT_PC_BP_SP;
 427   (void)sp;
 428   return asan_malloc_usable_size(BaseAddress, pc, bp);
 429 }
 430
 431 INTERCEPTOR_WINAPI(BOOL, RtlFreeHeap, HANDLE HeapHandle, DWORD Flags,
 432                    void* BaseAddress) {
 433   // Heap allocations happen before this function is hooked, so we must fall
 434   // back to the original function if the pointer is not from the ASAN heap, or
 435   // unsupported flags are provided.
 436   if (!flags()->windows_hook_rtl_allocators ||
 437       UNLIKELY((HEAP_FREE_UNSUPPORTED_FLAGS & Flags) != 0 ||
 438                OWNED_BY_RTL(HeapHandle, BaseAddress))) {
 439     return REAL(RtlFreeHeap)(HeapHandle, Flags, BaseAddress);
 440   }
 441   GET_STACK_TRACE_FREE;
 442   asan_free(BaseAddress, &stack, FROM_MALLOC);
 443   return true;
 444 }
 445
 446 INTERCEPTOR_WINAPI(void*, RtlAllocateHeap, HANDLE HeapHandle, DWORD Flags,
 447                    size_t Size) {
 448   // If the ASAN runtime is not initialized, or we encounter an unsupported
 449   // flag, fall back to the original allocator.
 450   if (!flags()->windows_hook_rtl_allocators ||
 451       UNLIKELY(!asan_inited ||
 452                (Flags & HEAP_ALLOCATE_UNSUPPORTED_FLAGS) != 0)) {
 453     return REAL(RtlAllocateHeap)(HeapHandle, Flags, Size);
 454   }
 455   GET_STACK_TRACE_MALLOC;
 456   void *p;
 457   // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
 458   // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
 459   // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
 460   if (Flags & HEAP_ZERO_MEMORY) {
 461     p = asan_calloc(Size, 1, &stack);
 462   } else {
 463     p = asan_malloc(Size, &stack);
 464   }
 465   return p;
 466 }
 467
 468 INTERCEPTOR_WINAPI(void*, RtlReAllocateHeap, HANDLE HeapHandle, DWORD Flags,
 469                    void* BaseAddress, size_t Size) {
 470   // If it's actually a heap block which was allocated before the ASAN runtime
 471   // came up, use the real RtlFreeHeap function.
 472   if (!flags()->windows_hook_rtl_allocators)
 473     return REAL(RtlReAllocateHeap)(HeapHandle, Flags, BaseAddress, Size);
 474
 475   return SharedReAlloc(REAL(RtlReAllocateHeap), REAL(RtlSizeHeap),
 476                        REAL(RtlFreeHeap), REAL(RtlAllocateHeap), HeapHandle,
 477                        Flags, BaseAddress, Size);
 478 }
 479
 480 namespace __asan {
 481
 482 static void TryToOverrideFunction(const char *fname, uptr new_func) {
 483   // Failure here is not fatal. The CRT may not be present, and different CRT
 484   // versions use different symbols.
 485   if (!__interception::OverrideFunction(fname, new_func))
 486     VPrintf(2, "Failed to override function %s\n", fname);
 487 }
 488
 489 void ReplaceSystemMalloc() {
 490 #if defined(ASAN_DYNAMIC)
 491   TryToOverrideFunction("free", (uptr)free);
 492   TryToOverrideFunction("_free_base", (uptr)free);
 493   TryToOverrideFunction("malloc", (uptr)malloc);
 494   TryToOverrideFunction("_malloc_base", (uptr)malloc);
 495   TryToOverrideFunction("_malloc_crt", (uptr)malloc);
 496   TryToOverrideFunction("calloc", (uptr)calloc);
 497   TryToOverrideFunction("_calloc_base", (uptr)calloc);
 498   TryToOverrideFunction("_calloc_crt", (uptr)calloc);
 499   TryToOverrideFunction("realloc", (uptr)realloc);
 500   TryToOverrideFunction("_realloc_base", (uptr)realloc);
 501   TryToOverrideFunction("_realloc_crt", (uptr)realloc);
 502   TryToOverrideFunction("_recalloc", (uptr)_recalloc);
 503   TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);
 504   TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);
 505   TryToOverrideFunction("_msize", (uptr)_msize);
 506   TryToOverrideFunction("_msize_base", (uptr)_msize);
 507   TryToOverrideFunction("_expand", (uptr)_expand);
 508   TryToOverrideFunction("_expand_base", (uptr)_expand);
 509
 510   if (flags()->windows_hook_rtl_allocators) {
 511     INTERCEPT_FUNCTION(HeapSize);
 512     INTERCEPT_FUNCTION(HeapFree);
 513     INTERCEPT_FUNCTION(HeapReAlloc);
 514     INTERCEPT_FUNCTION(HeapAlloc);
 515
 516     // Undocumented functions must be intercepted by name, not by symbol.
 517     __interception::OverrideFunction("RtlSizeHeap", (uptr)WRAP(RtlSizeHeap),
 518                                      (uptr *)&REAL(RtlSizeHeap));
 519     __interception::OverrideFunction("RtlFreeHeap", (uptr)WRAP(RtlFreeHeap),
 520                                      (uptr *)&REAL(RtlFreeHeap));
 521     __interception::OverrideFunction("RtlReAllocateHeap",
 522                                      (uptr)WRAP(RtlReAllocateHeap),
 523                                      (uptr *)&REAL(RtlReAllocateHeap));
 524     __interception::OverrideFunction("RtlAllocateHeap",
 525                                      (uptr)WRAP(RtlAllocateHeap),
 526                                      (uptr *)&REAL(RtlAllocateHeap));
 527   } else {
 528 #define INTERCEPT_UCRT_FUNCTION(func)                                  \
 529   if (!INTERCEPT_FUNCTION_DLLIMPORT(                                   \
 530           "ucrtbase.dll", "api-ms-win-core-heap-l1-1-0.dll", func)) {  \
 531     VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func); \
 532   }
 533     INTERCEPT_UCRT_FUNCTION(HeapAlloc);
 534     INTERCEPT_UCRT_FUNCTION(HeapFree);
 535     INTERCEPT_UCRT_FUNCTION(HeapReAlloc);
 536     INTERCEPT_UCRT_FUNCTION(HeapSize);
 537 #undef INTERCEPT_UCRT_FUNCTION
 538   }
 539   // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which
 540   // enable cross-module inlining. This means our _malloc_base hook won't catch
 541   // all CRT allocations. This code here patches the import table of
 542   // ucrtbase.dll so that all attempts to use the lower-level win32 heap
 543   // allocation API will be directed to ASan's heap. We don't currently
 544   // intercept all calls to HeapAlloc. If we did, we would have to check on
 545   // HeapFree whether the pointer came from ASan of from the system.
 546
 547 #endif  // defined(ASAN_DYNAMIC)
 548 }
 549 }  // namespace __asan
 550
 551 #endif  // _WIN32