1//===-- asan_malloc_win.cc ------------------------------------------------===// 2// 3// This file is distributed under the University of Illinois Open Source 4// License. See LICENSE.TXT for details. 5// 6//===----------------------------------------------------------------------===// 7// 8// This file is a part of AddressSanitizer, an address sanity checker. 9// 10// Windows-specific malloc interception. 11//===----------------------------------------------------------------------===// 12 13#include "sanitizer_common/sanitizer_platform.h" 14#if SANITIZER_WINDOWS 15// Intentionally not including windows.h here, to avoid the risk of 16// pulling in conflicting declarations of these functions. (With mingw-w64, 17// there's a risk of windows.h pulling in stdint.h.) 18typedef int BOOL; 19typedef void *HANDLE; 20typedef const void *LPCVOID; 21typedef void *LPVOID; 22 23#define HEAP_ZERO_MEMORY 0x00000008 24#define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010 25 26 27#include "asan_allocator.h" 28#include "asan_interceptors.h" 29#include "asan_internal.h" 30#include "asan_stack.h" 31#include "interception/interception.h" 32 33#include <stddef.h> 34 35using namespace __asan; // NOLINT 36 37// MT: Simply defining functions with the same signature in *.obj 38// files overrides the standard functions in the CRT. 39// MD: Memory allocation functions are defined in the CRT .dll, 40// so we have to intercept them before they are called for the first time. 41 42#if ASAN_DYNAMIC 43# define ALLOCATION_FUNCTION_ATTRIBUTE 44#else 45# define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE 46#endif 47 48extern "C" { 49ALLOCATION_FUNCTION_ATTRIBUTE 50void free(void *ptr) { 51 GET_STACK_TRACE_FREE; 52 return asan_free(ptr, &stack, FROM_MALLOC); 53} 54 55ALLOCATION_FUNCTION_ATTRIBUTE 56void _free_dbg(void *ptr, int) { 57 free(ptr); 58} 59 60ALLOCATION_FUNCTION_ATTRIBUTE 61void _free_base(void *ptr) { 62 free(ptr); 63} 64 65ALLOCATION_FUNCTION_ATTRIBUTE 66void *malloc(size_t size) { 67 GET_STACK_TRACE_MALLOC; 68 return asan_malloc(size, &stack); 69} 70 71ALLOCATION_FUNCTION_ATTRIBUTE 72void *_malloc_base(size_t size) { 73 return malloc(size); 74} 75 76ALLOCATION_FUNCTION_ATTRIBUTE 77void *_malloc_dbg(size_t size, int, const char *, int) { 78 return malloc(size); 79} 80 81ALLOCATION_FUNCTION_ATTRIBUTE 82void *calloc(size_t nmemb, size_t size) { 83 GET_STACK_TRACE_MALLOC; 84 return asan_calloc(nmemb, size, &stack); 85} 86 87ALLOCATION_FUNCTION_ATTRIBUTE 88void *_calloc_base(size_t nmemb, size_t size) { 89 return calloc(nmemb, size); 90} 91 92ALLOCATION_FUNCTION_ATTRIBUTE 93void *_calloc_dbg(size_t nmemb, size_t size, int, const char *, int) { 94 return calloc(nmemb, size); 95} 96 97ALLOCATION_FUNCTION_ATTRIBUTE 98void *_calloc_impl(size_t nmemb, size_t size, int *errno_tmp) { 99 return calloc(nmemb, size); 100} 101 102ALLOCATION_FUNCTION_ATTRIBUTE 103void *realloc(void *ptr, size_t size) { 104 GET_STACK_TRACE_MALLOC; 105 return asan_realloc(ptr, size, &stack); 106} 107 108ALLOCATION_FUNCTION_ATTRIBUTE 109void *_realloc_dbg(void *ptr, size_t size, int) { 110 UNREACHABLE("_realloc_dbg should not exist!"); 111 return 0; 112} 113 114ALLOCATION_FUNCTION_ATTRIBUTE 115void *_realloc_base(void *ptr, size_t size) { 116 return realloc(ptr, size); 117} 118 119ALLOCATION_FUNCTION_ATTRIBUTE 120void *_recalloc(void *p, size_t n, size_t elem_size) { 121 if (!p) 122 return calloc(n, elem_size); 123 const size_t size = n * elem_size; 124 if (elem_size != 0 && size / elem_size != n) 125 return 0; 126 return realloc(p, size); 127} 128 129ALLOCATION_FUNCTION_ATTRIBUTE 130void *_recalloc_base(void *p, size_t n, size_t elem_size) { 131 return _recalloc(p, n, elem_size); 132} 133 134ALLOCATION_FUNCTION_ATTRIBUTE 135size_t _msize(void *ptr) { 136 GET_CURRENT_PC_BP_SP; 137 (void)sp; 138 return asan_malloc_usable_size(ptr, pc, bp); 139} 140 141ALLOCATION_FUNCTION_ATTRIBUTE 142void *_expand(void *memblock, size_t size) { 143 // _expand is used in realloc-like functions to resize the buffer if possible. 144 // We don't want memory to stand still while resizing buffers, so return 0. 145 return 0; 146} 147 148ALLOCATION_FUNCTION_ATTRIBUTE 149void *_expand_dbg(void *memblock, size_t size) { 150 return _expand(memblock, size); 151} 152 153// TODO(timurrrr): Might want to add support for _aligned_* allocation 154// functions to detect a bit more bugs. Those functions seem to wrap malloc(). 155 156int _CrtDbgReport(int, const char*, int, 157 const char*, const char*, ...) { 158 ShowStatsAndAbort(); 159} 160 161int _CrtDbgReportW(int reportType, const wchar_t*, int, 162 const wchar_t*, const wchar_t*, ...) { 163 ShowStatsAndAbort(); 164} 165 166int _CrtSetReportMode(int, int) { 167 return 0; 168} 169} // extern "C" 170 171INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags, 172 SIZE_T dwBytes) { 173 GET_STACK_TRACE_MALLOC; 174 void *p = asan_malloc(dwBytes, &stack); 175 // Reading MSDN suggests that the *entire* usable allocation is zeroed out. 176 // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY. 177 // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083 178 if (dwFlags == HEAP_ZERO_MEMORY) 179 internal_memset(p, 0, asan_mz_size(p)); 180 else 181 CHECK(dwFlags == 0 && "unsupported heap flags"); 182 return p; 183} 184 185INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) { 186 CHECK(dwFlags == 0 && "unsupported heap flags"); 187 GET_STACK_TRACE_FREE; 188 asan_free(lpMem, &stack, FROM_MALLOC); 189 return true; 190} 191 192INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags, 193 LPVOID lpMem, SIZE_T dwBytes) { 194 GET_STACK_TRACE_MALLOC; 195 // Realloc should never reallocate in place. 196 if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY) 197 return nullptr; 198 CHECK(dwFlags == 0 && "unsupported heap flags"); 199 return asan_realloc(lpMem, dwBytes, &stack); 200} 201 202INTERCEPTOR_WINAPI(SIZE_T, HeapSize, HANDLE hHeap, DWORD dwFlags, 203 LPCVOID lpMem) { 204 CHECK(dwFlags == 0 && "unsupported heap flags"); 205 GET_CURRENT_PC_BP_SP; 206 (void)sp; 207 return asan_malloc_usable_size(lpMem, pc, bp); 208} 209 210namespace __asan { 211 212static void TryToOverrideFunction(const char *fname, uptr new_func) { 213 // Failure here is not fatal. The CRT may not be present, and different CRT 214 // versions use different symbols. 215 if (!__interception::OverrideFunction(fname, new_func)) 216 VPrintf(2, "Failed to override function %s\n", fname); 217} 218 219void ReplaceSystemMalloc() { 220#if defined(ASAN_DYNAMIC) 221 TryToOverrideFunction("free", (uptr)free); 222 TryToOverrideFunction("_free_base", (uptr)free); 223 TryToOverrideFunction("malloc", (uptr)malloc); 224 TryToOverrideFunction("_malloc_base", (uptr)malloc); 225 TryToOverrideFunction("_malloc_crt", (uptr)malloc); 226 TryToOverrideFunction("calloc", (uptr)calloc); 227 TryToOverrideFunction("_calloc_base", (uptr)calloc); 228 TryToOverrideFunction("_calloc_crt", (uptr)calloc); 229 TryToOverrideFunction("realloc", (uptr)realloc); 230 TryToOverrideFunction("_realloc_base", (uptr)realloc); 231 TryToOverrideFunction("_realloc_crt", (uptr)realloc); 232 TryToOverrideFunction("_recalloc", (uptr)_recalloc); 233 TryToOverrideFunction("_recalloc_base", (uptr)_recalloc); 234 TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc); 235 TryToOverrideFunction("_msize", (uptr)_msize); 236 TryToOverrideFunction("_expand", (uptr)_expand); 237 TryToOverrideFunction("_expand_base", (uptr)_expand); 238 239 // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which 240 // enable cross-module inlining. This means our _malloc_base hook won't catch 241 // all CRT allocations. This code here patches the import table of 242 // ucrtbase.dll so that all attempts to use the lower-level win32 heap 243 // allocation API will be directed to ASan's heap. We don't currently 244 // intercept all calls to HeapAlloc. If we did, we would have to check on 245 // HeapFree whether the pointer came from ASan of from the system. 246#define INTERCEPT_UCRT_FUNCTION(func) \ 247 if (!INTERCEPT_FUNCTION_DLLIMPORT("ucrtbase.dll", \ 248 "api-ms-win-core-heap-l1-1-0.dll", func)) \ 249 VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func); 250 INTERCEPT_UCRT_FUNCTION(HeapAlloc); 251 INTERCEPT_UCRT_FUNCTION(HeapFree); 252 INTERCEPT_UCRT_FUNCTION(HeapReAlloc); 253 INTERCEPT_UCRT_FUNCTION(HeapSize); 254#undef INTERCEPT_UCRT_FUNCTION 255#endif 256} 257} // namespace __asan 258 259#endif // _WIN32 260