1//===-- asan_malloc_win.cpp -----------------------------------------------===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file is a part of AddressSanitizer, an address sanity checker. 10// 11// Windows-specific malloc interception. 12//===----------------------------------------------------------------------===// 13 14#include "sanitizer_common/sanitizer_allocator_interface.h" 15#include "sanitizer_common/sanitizer_platform.h" 16#if SANITIZER_WINDOWS 17#include "asan_allocator.h" 18#include "asan_interceptors.h" 19#include "asan_internal.h" 20#include "asan_stack.h" 21#include "interception/interception.h" 22#include <stddef.h> 23 24// Intentionally not including windows.h here, to avoid the risk of 25// pulling in conflicting declarations of these functions. (With mingw-w64, 26// there's a risk of windows.h pulling in stdint.h.) 27typedef int BOOL; 28typedef void *HANDLE; 29typedef const void *LPCVOID; 30typedef void *LPVOID; 31 32typedef unsigned long DWORD; 33constexpr unsigned long HEAP_ZERO_MEMORY = 0x00000008; 34constexpr unsigned long HEAP_REALLOC_IN_PLACE_ONLY = 0x00000010; 35constexpr unsigned long HEAP_ALLOCATE_SUPPORTED_FLAGS = (HEAP_ZERO_MEMORY); 36constexpr unsigned long HEAP_ALLOCATE_UNSUPPORTED_FLAGS = 37 (~HEAP_ALLOCATE_SUPPORTED_FLAGS); 38constexpr unsigned long HEAP_FREE_UNSUPPORTED_FLAGS = 39 (~HEAP_ALLOCATE_SUPPORTED_FLAGS); 40constexpr unsigned long HEAP_REALLOC_UNSUPPORTED_FLAGS = 41 (~HEAP_ALLOCATE_SUPPORTED_FLAGS); 42 43 44extern "C" { 45LPVOID WINAPI HeapAlloc(HANDLE hHeap, DWORD dwFlags, size_t dwBytes); 46LPVOID WINAPI HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, 47 size_t dwBytes); 48BOOL WINAPI HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem); 49size_t WINAPI HeapSize(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem); 50 51BOOL WINAPI HeapValidate(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem); 52} 53 54using namespace __asan; 55 56// MT: Simply defining functions with the same signature in *.obj 57// files overrides the standard functions in the CRT. 58// MD: Memory allocation functions are defined in the CRT .dll, 59// so we have to intercept them before they are called for the first time. 60 61#if ASAN_DYNAMIC 62# define ALLOCATION_FUNCTION_ATTRIBUTE 63#else 64# define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE 65#endif 66 67extern "C" { 68ALLOCATION_FUNCTION_ATTRIBUTE 69size_t _msize(void *ptr) { 70 GET_CURRENT_PC_BP_SP; 71 (void)sp; 72 return asan_malloc_usable_size(ptr, pc, bp); 73} 74 75ALLOCATION_FUNCTION_ATTRIBUTE 76size_t _msize_base(void *ptr) { 77 return _msize(ptr); 78} 79 80ALLOCATION_FUNCTION_ATTRIBUTE 81void free(void *ptr) { 82 GET_STACK_TRACE_FREE; 83 return asan_free(ptr, &stack, FROM_MALLOC); 84} 85 86ALLOCATION_FUNCTION_ATTRIBUTE 87void _free_dbg(void *ptr, int) { 88 free(ptr); 89} 90 91ALLOCATION_FUNCTION_ATTRIBUTE 92void _free_base(void *ptr) { 93 free(ptr); 94} 95 96ALLOCATION_FUNCTION_ATTRIBUTE 97void *malloc(size_t size) { 98 GET_STACK_TRACE_MALLOC; 99 return asan_malloc(size, &stack); 100} 101 102ALLOCATION_FUNCTION_ATTRIBUTE 103void *_malloc_base(size_t size) { 104 return malloc(size); 105} 106 107ALLOCATION_FUNCTION_ATTRIBUTE 108void *_malloc_dbg(size_t size, int, const char *, int) { 109 return malloc(size); 110} 111 112ALLOCATION_FUNCTION_ATTRIBUTE 113void *calloc(size_t nmemb, size_t size) { 114 GET_STACK_TRACE_MALLOC; 115 return asan_calloc(nmemb, size, &stack); 116} 117 118ALLOCATION_FUNCTION_ATTRIBUTE 119void *_calloc_base(size_t nmemb, size_t size) { 120 return calloc(nmemb, size); 121} 122 123ALLOCATION_FUNCTION_ATTRIBUTE 124void *_calloc_dbg(size_t nmemb, size_t size, int, const char *, int) { 125 return calloc(nmemb, size); 126} 127 128ALLOCATION_FUNCTION_ATTRIBUTE 129void *_calloc_impl(size_t nmemb, size_t size, int *errno_tmp) { 130 return calloc(nmemb, size); 131} 132 133ALLOCATION_FUNCTION_ATTRIBUTE 134void *realloc(void *ptr, size_t size) { 135 GET_STACK_TRACE_MALLOC; 136 return asan_realloc(ptr, size, &stack); 137} 138 139ALLOCATION_FUNCTION_ATTRIBUTE 140void *_realloc_dbg(void *ptr, size_t size, int) { 141 UNREACHABLE("_realloc_dbg should not exist!"); 142 return 0; 143} 144 145ALLOCATION_FUNCTION_ATTRIBUTE 146void *_realloc_base(void *ptr, size_t size) { 147 return realloc(ptr, size); 148} 149 150ALLOCATION_FUNCTION_ATTRIBUTE 151void *_recalloc(void *p, size_t n, size_t elem_size) { 152 if (!p) 153 return calloc(n, elem_size); 154 const size_t size = n * elem_size; 155 if (elem_size != 0 && size / elem_size != n) 156 return 0; 157 158 size_t old_size = _msize(p); 159 void *new_alloc = malloc(size); 160 if (new_alloc) { 161 REAL(memcpy)(new_alloc, p, Min<size_t>(size, old_size)); 162 if (old_size < size) 163 REAL(memset)(((u8 *)new_alloc) + old_size, 0, size - old_size); 164 free(p); 165 } 166 return new_alloc; 167} 168 169ALLOCATION_FUNCTION_ATTRIBUTE 170void *_recalloc_base(void *p, size_t n, size_t elem_size) { 171 return _recalloc(p, n, elem_size); 172} 173 174ALLOCATION_FUNCTION_ATTRIBUTE 175void *_expand(void *memblock, size_t size) { 176 // _expand is used in realloc-like functions to resize the buffer if possible. 177 // We don't want memory to stand still while resizing buffers, so return 0. 178 return 0; 179} 180 181ALLOCATION_FUNCTION_ATTRIBUTE 182void *_expand_dbg(void *memblock, size_t size) { 183 return _expand(memblock, size); 184} 185 186// TODO(timurrrr): Might want to add support for _aligned_* allocation 187// functions to detect a bit more bugs. Those functions seem to wrap malloc(). 188 189int _CrtDbgReport(int, const char*, int, 190 const char*, const char*, ...) { 191 ShowStatsAndAbort(); 192} 193 194int _CrtDbgReportW(int reportType, const wchar_t*, int, 195 const wchar_t*, const wchar_t*, ...) { 196 ShowStatsAndAbort(); 197} 198 199int _CrtSetReportMode(int, int) { 200 return 0; 201} 202} // extern "C" 203 204#define OWNED_BY_RTL(heap, memory) \ 205 (!__sanitizer_get_ownership(memory) && HeapValidate(heap, 0, memory)) 206 207INTERCEPTOR_WINAPI(size_t, HeapSize, HANDLE hHeap, DWORD dwFlags, 208 LPCVOID lpMem) { 209 // If the RTL allocators are hooked we need to check whether the ASAN 210 // allocator owns the pointer we're about to use. Allocations occur before 211 // interception takes place, so if it is not owned by the RTL heap we can 212 // pass it to the ASAN heap for inspection. 213 if (flags()->windows_hook_rtl_allocators) { 214 if (!AsanInited() || OWNED_BY_RTL(hHeap, lpMem)) 215 return REAL(HeapSize)(hHeap, dwFlags, lpMem); 216 } else { 217 CHECK(dwFlags == 0 && "unsupported heap flags"); 218 } 219 GET_CURRENT_PC_BP_SP; 220 (void)sp; 221 return asan_malloc_usable_size(lpMem, pc, bp); 222} 223 224INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags, 225 size_t dwBytes) { 226 // If the ASAN runtime is not initialized, or we encounter an unsupported 227 // flag, fall back to the original allocator. 228 if (flags()->windows_hook_rtl_allocators) { 229 if (UNLIKELY(!AsanInited() || 230 (dwFlags & HEAP_ALLOCATE_UNSUPPORTED_FLAGS) != 0)) { 231 return REAL(HeapAlloc)(hHeap, dwFlags, dwBytes); 232 } 233 } else { 234 // In the case that we don't hook the rtl allocators, 235 // this becomes an assert since there is no failover to the original 236 // allocator. 237 CHECK((HEAP_ALLOCATE_UNSUPPORTED_FLAGS & dwFlags) != 0 && 238 "unsupported flags"); 239 } 240 GET_STACK_TRACE_MALLOC; 241 void *p = asan_malloc(dwBytes, &stack); 242 // Reading MSDN suggests that the *entire* usable allocation is zeroed out. 243 // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY. 244 // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083 245 if (p && (dwFlags & HEAP_ZERO_MEMORY)) { 246 GET_CURRENT_PC_BP_SP; 247 (void)sp; 248 auto usable_size = asan_malloc_usable_size(p, pc, bp); 249 internal_memset(p, 0, usable_size); 250 } 251 return p; 252} 253 254INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) { 255 // Heap allocations happen before this function is hooked, so we must fall 256 // back to the original function if the pointer is not from the ASAN heap, 257 // or unsupported flags are provided. 258 if (flags()->windows_hook_rtl_allocators) { 259 if (OWNED_BY_RTL(hHeap, lpMem)) 260 return REAL(HeapFree)(hHeap, dwFlags, lpMem); 261 } else { 262 CHECK((HEAP_FREE_UNSUPPORTED_FLAGS & dwFlags) != 0 && "unsupported flags"); 263 } 264 GET_STACK_TRACE_FREE; 265 asan_free(lpMem, &stack, FROM_MALLOC); 266 return true; 267} 268 269namespace __asan { 270using AllocFunction = LPVOID(WINAPI *)(HANDLE, DWORD, size_t); 271using ReAllocFunction = LPVOID(WINAPI *)(HANDLE, DWORD, LPVOID, size_t); 272using SizeFunction = size_t(WINAPI *)(HANDLE, DWORD, LPVOID); 273using FreeFunction = BOOL(WINAPI *)(HANDLE, DWORD, LPVOID); 274 275void *SharedReAlloc(ReAllocFunction reallocFunc, SizeFunction heapSizeFunc, 276 FreeFunction freeFunc, AllocFunction allocFunc, 277 HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, size_t dwBytes) { 278 CHECK(reallocFunc && heapSizeFunc && freeFunc && allocFunc); 279 GET_STACK_TRACE_MALLOC; 280 GET_CURRENT_PC_BP_SP; 281 (void)sp; 282 if (flags()->windows_hook_rtl_allocators) { 283 enum AllocationOwnership { NEITHER = 0, ASAN = 1, RTL = 2 }; 284 AllocationOwnership ownershipState; 285 bool owned_rtlalloc = false; 286 bool owned_asan = __sanitizer_get_ownership(lpMem); 287 288 if (!owned_asan) 289 owned_rtlalloc = HeapValidate(hHeap, 0, lpMem); 290 291 if (owned_asan && !owned_rtlalloc) 292 ownershipState = ASAN; 293 else if (!owned_asan && owned_rtlalloc) 294 ownershipState = RTL; 295 else if (!owned_asan && !owned_rtlalloc) 296 ownershipState = NEITHER; 297 298 // If this heap block which was allocated before the ASAN 299 // runtime came up, use the real HeapFree function. 300 if (UNLIKELY(!AsanInited())) { 301 return reallocFunc(hHeap, dwFlags, lpMem, dwBytes); 302 } 303 bool only_asan_supported_flags = 304 (HEAP_REALLOC_UNSUPPORTED_FLAGS & dwFlags) == 0; 305 306 if (ownershipState == RTL || 307 (ownershipState == NEITHER && !only_asan_supported_flags)) { 308 if (only_asan_supported_flags) { 309 // if this is a conversion to ASAN upported flags, transfer this 310 // allocation to the ASAN allocator 311 void *replacement_alloc; 312 if (dwFlags & HEAP_ZERO_MEMORY) 313 replacement_alloc = asan_calloc(1, dwBytes, &stack); 314 else 315 replacement_alloc = asan_malloc(dwBytes, &stack); 316 if (replacement_alloc) { 317 size_t old_size = heapSizeFunc(hHeap, dwFlags, lpMem); 318 if (old_size == ((size_t)0) - 1) { 319 asan_free(replacement_alloc, &stack, FROM_MALLOC); 320 return nullptr; 321 } 322 REAL(memcpy)(replacement_alloc, lpMem, old_size); 323 freeFunc(hHeap, dwFlags, lpMem); 324 } 325 return replacement_alloc; 326 } else { 327 // owned by rtl or neither with unsupported ASAN flags, 328 // just pass back to original allocator 329 CHECK(ownershipState == RTL || ownershipState == NEITHER); 330 CHECK(!only_asan_supported_flags); 331 return reallocFunc(hHeap, dwFlags, lpMem, dwBytes); 332 } 333 } 334 335 if (ownershipState == ASAN && !only_asan_supported_flags) { 336 // Conversion to unsupported flags allocation, 337 // transfer this allocation back to the original allocator. 338 void *replacement_alloc = allocFunc(hHeap, dwFlags, dwBytes); 339 size_t old_usable_size = 0; 340 if (replacement_alloc) { 341 old_usable_size = asan_malloc_usable_size(lpMem, pc, bp); 342 REAL(memcpy)(replacement_alloc, lpMem, 343 Min<size_t>(dwBytes, old_usable_size)); 344 asan_free(lpMem, &stack, FROM_MALLOC); 345 } 346 return replacement_alloc; 347 } 348 349 CHECK((ownershipState == ASAN || ownershipState == NEITHER) && 350 only_asan_supported_flags); 351 // At this point we should either be ASAN owned with ASAN supported flags 352 // or we owned by neither and have supported flags. 353 // Pass through even when it's neither since this could be a null realloc or 354 // UAF that ASAN needs to catch. 355 } else { 356 CHECK((HEAP_REALLOC_UNSUPPORTED_FLAGS & dwFlags) != 0 && 357 "unsupported flags"); 358 } 359 // asan_realloc will never reallocate in place, so for now this flag is 360 // unsupported until we figure out a way to fake this. 361 if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY) 362 return nullptr; 363 364 // HeapReAlloc and HeapAlloc both happily accept 0 sized allocations. 365 // passing a 0 size into asan_realloc will free the allocation. 366 // To avoid this and keep behavior consistent, fudge the size if 0. 367 // (asan_malloc already does this) 368 if (dwBytes == 0) 369 dwBytes = 1; 370 371 size_t old_size; 372 if (dwFlags & HEAP_ZERO_MEMORY) 373 old_size = asan_malloc_usable_size(lpMem, pc, bp); 374 375 void *ptr = asan_realloc(lpMem, dwBytes, &stack); 376 if (ptr == nullptr) 377 return nullptr; 378 379 if (dwFlags & HEAP_ZERO_MEMORY) { 380 size_t new_size = asan_malloc_usable_size(ptr, pc, bp); 381 if (old_size < new_size) 382 REAL(memset)(((u8 *)ptr) + old_size, 0, new_size - old_size); 383 } 384 385 return ptr; 386} 387} // namespace __asan 388 389INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags, 390 LPVOID lpMem, size_t dwBytes) { 391 return SharedReAlloc(REAL(HeapReAlloc), (SizeFunction)REAL(HeapSize), 392 REAL(HeapFree), REAL(HeapAlloc), hHeap, dwFlags, lpMem, 393 dwBytes); 394} 395 396// The following functions are undocumented and subject to change. 397// However, hooking them is necessary to hook Windows heap 398// allocations with detours and their definitions are unlikely to change. 399// Comments in /minkernel/ntos/rtl/heappublic.c indicate that these functions 400// are part of the heap's public interface. 401typedef unsigned long LOGICAL; 402 403// This function is documented as part of the Driver Development Kit but *not* 404// the Windows Development Kit. 405LOGICAL RtlFreeHeap(void* HeapHandle, DWORD Flags, 406 void* BaseAddress); 407 408// This function is documented as part of the Driver Development Kit but *not* 409// the Windows Development Kit. 410void* RtlAllocateHeap(void* HeapHandle, DWORD Flags, size_t Size); 411 412// This function is completely undocumented. 413void* 414RtlReAllocateHeap(void* HeapHandle, DWORD Flags, void* BaseAddress, 415 size_t Size); 416 417// This function is completely undocumented. 418size_t RtlSizeHeap(void* HeapHandle, DWORD Flags, void* BaseAddress); 419 420INTERCEPTOR_WINAPI(size_t, RtlSizeHeap, HANDLE HeapHandle, DWORD Flags, 421 void* BaseAddress) { 422 if (!flags()->windows_hook_rtl_allocators || 423 UNLIKELY(!AsanInited() || OWNED_BY_RTL(HeapHandle, BaseAddress))) { 424 return REAL(RtlSizeHeap)(HeapHandle, Flags, BaseAddress); 425 } 426 GET_CURRENT_PC_BP_SP; 427 (void)sp; 428 return asan_malloc_usable_size(BaseAddress, pc, bp); 429} 430 431INTERCEPTOR_WINAPI(BOOL, RtlFreeHeap, HANDLE HeapHandle, DWORD Flags, 432 void* BaseAddress) { 433 // Heap allocations happen before this function is hooked, so we must fall 434 // back to the original function if the pointer is not from the ASAN heap, or 435 // unsupported flags are provided. 436 if (!flags()->windows_hook_rtl_allocators || 437 UNLIKELY((HEAP_FREE_UNSUPPORTED_FLAGS & Flags) != 0 || 438 OWNED_BY_RTL(HeapHandle, BaseAddress))) { 439 return REAL(RtlFreeHeap)(HeapHandle, Flags, BaseAddress); 440 } 441 GET_STACK_TRACE_FREE; 442 asan_free(BaseAddress, &stack, FROM_MALLOC); 443 return true; 444} 445 446INTERCEPTOR_WINAPI(void*, RtlAllocateHeap, HANDLE HeapHandle, DWORD Flags, 447 size_t Size) { 448 // If the ASAN runtime is not initialized, or we encounter an unsupported 449 // flag, fall back to the original allocator. 450 if (!flags()->windows_hook_rtl_allocators || 451 UNLIKELY(!AsanInited() || 452 (Flags & HEAP_ALLOCATE_UNSUPPORTED_FLAGS) != 0)) { 453 return REAL(RtlAllocateHeap)(HeapHandle, Flags, Size); 454 } 455 GET_STACK_TRACE_MALLOC; 456 void *p; 457 // Reading MSDN suggests that the *entire* usable allocation is zeroed out. 458 // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY. 459 // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083 460 if (Flags & HEAP_ZERO_MEMORY) { 461 p = asan_calloc(Size, 1, &stack); 462 } else { 463 p = asan_malloc(Size, &stack); 464 } 465 return p; 466} 467 468INTERCEPTOR_WINAPI(void*, RtlReAllocateHeap, HANDLE HeapHandle, DWORD Flags, 469 void* BaseAddress, size_t Size) { 470 // If it's actually a heap block which was allocated before the ASAN runtime 471 // came up, use the real RtlFreeHeap function. 472 if (!flags()->windows_hook_rtl_allocators) 473 return REAL(RtlReAllocateHeap)(HeapHandle, Flags, BaseAddress, Size); 474 475 return SharedReAlloc(REAL(RtlReAllocateHeap), REAL(RtlSizeHeap), 476 REAL(RtlFreeHeap), REAL(RtlAllocateHeap), HeapHandle, 477 Flags, BaseAddress, Size); 478} 479 480namespace __asan { 481 482static void TryToOverrideFunction(const char *fname, uptr new_func) { 483 // Failure here is not fatal. The CRT may not be present, and different CRT 484 // versions use different symbols. 485 if (!__interception::OverrideFunction(fname, new_func)) 486 VPrintf(2, "Failed to override function %s\n", fname); 487} 488 489void ReplaceSystemMalloc() { 490#if defined(ASAN_DYNAMIC) 491 TryToOverrideFunction("free", (uptr)free); 492 TryToOverrideFunction("_free_base", (uptr)free); 493 TryToOverrideFunction("malloc", (uptr)malloc); 494 TryToOverrideFunction("_malloc_base", (uptr)malloc); 495 TryToOverrideFunction("_malloc_crt", (uptr)malloc); 496 TryToOverrideFunction("calloc", (uptr)calloc); 497 TryToOverrideFunction("_calloc_base", (uptr)calloc); 498 TryToOverrideFunction("_calloc_crt", (uptr)calloc); 499 TryToOverrideFunction("realloc", (uptr)realloc); 500 TryToOverrideFunction("_realloc_base", (uptr)realloc); 501 TryToOverrideFunction("_realloc_crt", (uptr)realloc); 502 TryToOverrideFunction("_recalloc", (uptr)_recalloc); 503 TryToOverrideFunction("_recalloc_base", (uptr)_recalloc); 504 TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc); 505 TryToOverrideFunction("_msize", (uptr)_msize); 506 TryToOverrideFunction("_msize_base", (uptr)_msize); 507 TryToOverrideFunction("_expand", (uptr)_expand); 508 TryToOverrideFunction("_expand_base", (uptr)_expand); 509 510 if (flags()->windows_hook_rtl_allocators) { 511 ASAN_INTERCEPT_FUNC(HeapSize); 512 ASAN_INTERCEPT_FUNC(HeapFree); 513 ASAN_INTERCEPT_FUNC(HeapReAlloc); 514 ASAN_INTERCEPT_FUNC(HeapAlloc); 515 516 // Undocumented functions must be intercepted by name, not by symbol. 517 __interception::OverrideFunction("RtlSizeHeap", (uptr)WRAP(RtlSizeHeap), 518 (uptr *)&REAL(RtlSizeHeap)); 519 __interception::OverrideFunction("RtlFreeHeap", (uptr)WRAP(RtlFreeHeap), 520 (uptr *)&REAL(RtlFreeHeap)); 521 __interception::OverrideFunction("RtlReAllocateHeap", 522 (uptr)WRAP(RtlReAllocateHeap), 523 (uptr *)&REAL(RtlReAllocateHeap)); 524 __interception::OverrideFunction("RtlAllocateHeap", 525 (uptr)WRAP(RtlAllocateHeap), 526 (uptr *)&REAL(RtlAllocateHeap)); 527 } else { 528#define INTERCEPT_UCRT_FUNCTION(func) \ 529 if (!INTERCEPT_FUNCTION_DLLIMPORT( \ 530 "ucrtbase.dll", "api-ms-win-core-heap-l1-1-0.dll", func)) { \ 531 VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func); \ 532 } 533 INTERCEPT_UCRT_FUNCTION(HeapAlloc); 534 INTERCEPT_UCRT_FUNCTION(HeapFree); 535 INTERCEPT_UCRT_FUNCTION(HeapReAlloc); 536 INTERCEPT_UCRT_FUNCTION(HeapSize); 537#undef INTERCEPT_UCRT_FUNCTION 538 } 539 // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which 540 // enable cross-module inlining. This means our _malloc_base hook won't catch 541 // all CRT allocations. This code here patches the import table of 542 // ucrtbase.dll so that all attempts to use the lower-level win32 heap 543 // allocation API will be directed to ASan's heap. We don't currently 544 // intercept all calls to HeapAlloc. If we did, we would have to check on 545 // HeapFree whether the pointer came from ASan of from the system. 546 547#endif // defined(ASAN_DYNAMIC) 548} 549} // namespace __asan 550 551#endif // _WIN32 552