libsanitizer/asan/asan_malloc_win.cc

   1 //===-- asan_malloc_win.cc ------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of AddressSanitizer, an address sanity checker.
   9 //
  10 // Windows-specific malloc interception.
  11 //===----------------------------------------------------------------------===//
  12
  13 #include "sanitizer_common/sanitizer_platform.h"
  14 #if SANITIZER_WINDOWS
  15 // Intentionally not including windows.h here, to avoid the risk of
  16 // pulling in conflicting declarations of these functions. (With mingw-w64,
  17 // there's a risk of windows.h pulling in stdint.h.)
  18 typedef int BOOL;
  19 typedef void *HANDLE;
  20 typedef const void *LPCVOID;
  21 typedef void *LPVOID;
  22
  23 #define HEAP_ZERO_MEMORY           0x00000008
  24 #define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010
  25
  26
  27 #include "asan_allocator.h"
  28 #include "asan_interceptors.h"
  29 #include "asan_internal.h"
  30 #include "asan_stack.h"
  31 #include "interception/interception.h"
  32
  33 #include <stddef.h>
  34
  35 using namespace __asan;  // NOLINT
  36
  37 // MT: Simply defining functions with the same signature in *.obj
  38 // files overrides the standard functions in the CRT.
  39 // MD: Memory allocation functions are defined in the CRT .dll,
  40 // so we have to intercept them before they are called for the first time.
  41
  42 #if ASAN_DYNAMIC
  43 # define ALLOCATION_FUNCTION_ATTRIBUTE
  44 #else
  45 # define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
  46 #endif
  47
  48 extern "C" {
  49 ALLOCATION_FUNCTION_ATTRIBUTE
  50 void free(void *ptr) {
  51   GET_STACK_TRACE_FREE;
  52   return asan_free(ptr, &stack, FROM_MALLOC);
  53 }
  54
  55 ALLOCATION_FUNCTION_ATTRIBUTE
  56 void _free_dbg(void *ptr, int) {
  57   free(ptr);
  58 }
  59
  60 ALLOCATION_FUNCTION_ATTRIBUTE
  61 void _free_base(void *ptr) {
  62   free(ptr);
  63 }
  64
  65 ALLOCATION_FUNCTION_ATTRIBUTE
  66 void *malloc(size_t size) {
  67   GET_STACK_TRACE_MALLOC;
  68   return asan_malloc(size, &stack);
  69 }
  70
  71 ALLOCATION_FUNCTION_ATTRIBUTE
  72 void *_malloc_base(size_t size) {
  73   return malloc(size);
  74 }
  75
  76 ALLOCATION_FUNCTION_ATTRIBUTE
  77 void *_malloc_dbg(size_t size, int, const char *, int) {
  78   return malloc(size);
  79 }
  80
  81 ALLOCATION_FUNCTION_ATTRIBUTE
  82 void *calloc(size_t nmemb, size_t size) {
  83   GET_STACK_TRACE_MALLOC;
  84   return asan_calloc(nmemb, size, &stack);
  85 }
  86
  87 ALLOCATION_FUNCTION_ATTRIBUTE
  88 void *_calloc_base(size_t nmemb, size_t size) {
  89   return calloc(nmemb, size);
  90 }
  91
  92 ALLOCATION_FUNCTION_ATTRIBUTE
  93 void *_calloc_dbg(size_t nmemb, size_t size, int, const char *, int) {
  94   return calloc(nmemb, size);
  95 }
  96
  97 ALLOCATION_FUNCTION_ATTRIBUTE
  98 void *_calloc_impl(size_t nmemb, size_t size, int *errno_tmp) {
  99   return calloc(nmemb, size);
 100 }
 101
 102 ALLOCATION_FUNCTION_ATTRIBUTE
 103 void *realloc(void *ptr, size_t size) {
 104   GET_STACK_TRACE_MALLOC;
 105   return asan_realloc(ptr, size, &stack);
 106 }
 107
 108 ALLOCATION_FUNCTION_ATTRIBUTE
 109 void *_realloc_dbg(void *ptr, size_t size, int) {
 110   UNREACHABLE("_realloc_dbg should not exist!");
 111   return 0;
 112 }
 113
 114 ALLOCATION_FUNCTION_ATTRIBUTE
 115 void *_realloc_base(void *ptr, size_t size) {
 116   return realloc(ptr, size);
 117 }
 118
 119 ALLOCATION_FUNCTION_ATTRIBUTE
 120 void *_recalloc(void *p, size_t n, size_t elem_size) {
 121   if (!p)
 122     return calloc(n, elem_size);
 123   const size_t size = n * elem_size;
 124   if (elem_size != 0 && size / elem_size != n)
 125     return 0;
 126   return realloc(p, size);
 127 }
 128
 129 ALLOCATION_FUNCTION_ATTRIBUTE
 130 void *_recalloc_base(void *p, size_t n, size_t elem_size) {
 131   return _recalloc(p, n, elem_size);
 132 }
 133
 134 ALLOCATION_FUNCTION_ATTRIBUTE
 135 size_t _msize(void *ptr) {
 136   GET_CURRENT_PC_BP_SP;
 137   (void)sp;
 138   return asan_malloc_usable_size(ptr, pc, bp);
 139 }
 140
 141 ALLOCATION_FUNCTION_ATTRIBUTE
 142 void *_expand(void *memblock, size_t size) {
 143   // _expand is used in realloc-like functions to resize the buffer if possible.
 144   // We don't want memory to stand still while resizing buffers, so return 0.
 145   return 0;
 146 }
 147
 148 ALLOCATION_FUNCTION_ATTRIBUTE
 149 void *_expand_dbg(void *memblock, size_t size) {
 150   return _expand(memblock, size);
 151 }
 152
 153 // TODO(timurrrr): Might want to add support for _aligned_* allocation
 154 // functions to detect a bit more bugs.  Those functions seem to wrap malloc().
 155
 156 int _CrtDbgReport(int, const char*, int,
 157                   const char*, const char*, ...) {
 158   ShowStatsAndAbort();
 159 }
 160
 161 int _CrtDbgReportW(int reportType, const wchar_t*, int,
 162                    const wchar_t*, const wchar_t*, ...) {
 163   ShowStatsAndAbort();
 164 }
 165
 166 int _CrtSetReportMode(int, int) {
 167   return 0;
 168 }
 169 }  // extern "C"
 170
 171 INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags,
 172                    SIZE_T dwBytes) {
 173   GET_STACK_TRACE_MALLOC;
 174   void *p = asan_malloc(dwBytes, &stack);
 175   // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
 176   // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
 177   // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
 178   if (dwFlags == HEAP_ZERO_MEMORY)
 179     internal_memset(p, 0, asan_mz_size(p));
 180   else
 181     CHECK(dwFlags == 0 && "unsupported heap flags");
 182   return p;
 183 }
 184
 185 INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) {
 186   CHECK(dwFlags == 0 && "unsupported heap flags");
 187   GET_STACK_TRACE_FREE;
 188   asan_free(lpMem, &stack, FROM_MALLOC);
 189   return true;
 190 }
 191
 192 INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags,
 193                    LPVOID lpMem, SIZE_T dwBytes) {
 194   GET_STACK_TRACE_MALLOC;
 195   // Realloc should never reallocate in place.
 196   if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY)
 197     return nullptr;
 198   CHECK(dwFlags == 0 && "unsupported heap flags");
 199   return asan_realloc(lpMem, dwBytes, &stack);
 200 }
 201
 202 INTERCEPTOR_WINAPI(SIZE_T, HeapSize, HANDLE hHeap, DWORD dwFlags,
 203                    LPCVOID lpMem) {
 204   CHECK(dwFlags == 0 && "unsupported heap flags");
 205   GET_CURRENT_PC_BP_SP;
 206   (void)sp;
 207   return asan_malloc_usable_size(lpMem, pc, bp);
 208 }
 209
 210 namespace __asan {
 211
 212 static void TryToOverrideFunction(const char *fname, uptr new_func) {
 213   // Failure here is not fatal. The CRT may not be present, and different CRT
 214   // versions use different symbols.
 215   if (!__interception::OverrideFunction(fname, new_func))
 216     VPrintf(2, "Failed to override function %s\n", fname);
 217 }
 218
 219 void ReplaceSystemMalloc() {
 220 #if defined(ASAN_DYNAMIC)
 221   TryToOverrideFunction("free", (uptr)free);
 222   TryToOverrideFunction("_free_base", (uptr)free);
 223   TryToOverrideFunction("malloc", (uptr)malloc);
 224   TryToOverrideFunction("_malloc_base", (uptr)malloc);
 225   TryToOverrideFunction("_malloc_crt", (uptr)malloc);
 226   TryToOverrideFunction("calloc", (uptr)calloc);
 227   TryToOverrideFunction("_calloc_base", (uptr)calloc);
 228   TryToOverrideFunction("_calloc_crt", (uptr)calloc);
 229   TryToOverrideFunction("realloc", (uptr)realloc);
 230   TryToOverrideFunction("_realloc_base", (uptr)realloc);
 231   TryToOverrideFunction("_realloc_crt", (uptr)realloc);
 232   TryToOverrideFunction("_recalloc", (uptr)_recalloc);
 233   TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);
 234   TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);
 235   TryToOverrideFunction("_msize", (uptr)_msize);
 236   TryToOverrideFunction("_expand", (uptr)_expand);
 237   TryToOverrideFunction("_expand_base", (uptr)_expand);
 238
 239   // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which
 240   // enable cross-module inlining. This means our _malloc_base hook won't catch
 241   // all CRT allocations. This code here patches the import table of
 242   // ucrtbase.dll so that all attempts to use the lower-level win32 heap
 243   // allocation API will be directed to ASan's heap. We don't currently
 244   // intercept all calls to HeapAlloc. If we did, we would have to check on
 245   // HeapFree whether the pointer came from ASan of from the system.
 246 #define INTERCEPT_UCRT_FUNCTION(func)                                         \
 247   if (!INTERCEPT_FUNCTION_DLLIMPORT("ucrtbase.dll",                           \
 248                                     "api-ms-win-core-heap-l1-1-0.dll", func)) \
 249     VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func);
 250   INTERCEPT_UCRT_FUNCTION(HeapAlloc);
 251   INTERCEPT_UCRT_FUNCTION(HeapFree);
 252   INTERCEPT_UCRT_FUNCTION(HeapReAlloc);
 253   INTERCEPT_UCRT_FUNCTION(HeapSize);
 254 #undef INTERCEPT_UCRT_FUNCTION
 255 #endif
 256 }
 257 }  // namespace __asan
 258
 259 #endif  // _WIN32