1//===-- asan_malloc_win.cc ------------------------------------------------===//
2//
3// This file is distributed under the University of Illinois Open Source
4// License. See LICENSE.TXT for details.
5//
6//===----------------------------------------------------------------------===//
7//
8// This file is a part of AddressSanitizer, an address sanity checker.
9//
10// Windows-specific malloc interception.
11//===----------------------------------------------------------------------===//
12
13#include "sanitizer_common/sanitizer_platform.h"
14#if SANITIZER_WINDOWS
15// Intentionally not including windows.h here, to avoid the risk of
16// pulling in conflicting declarations of these functions. (With mingw-w64,
17// there's a risk of windows.h pulling in stdint.h.)
18typedef int BOOL;
19typedef void *HANDLE;
20typedef const void *LPCVOID;
21typedef void *LPVOID;
22
23#define HEAP_ZERO_MEMORY           0x00000008
24#define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010
25
26
27#include "asan_allocator.h"
28#include "asan_interceptors.h"
29#include "asan_internal.h"
30#include "asan_stack.h"
31#include "interception/interception.h"
32
33#include <stddef.h>
34
35using namespace __asan;  // NOLINT
36
37// MT: Simply defining functions with the same signature in *.obj
38// files overrides the standard functions in the CRT.
39// MD: Memory allocation functions are defined in the CRT .dll,
40// so we have to intercept them before they are called for the first time.
41
42#if ASAN_DYNAMIC
43# define ALLOCATION_FUNCTION_ATTRIBUTE
44#else
45# define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
46#endif
47
48extern "C" {
49ALLOCATION_FUNCTION_ATTRIBUTE
50void free(void *ptr) {
51  GET_STACK_TRACE_FREE;
52  return asan_free(ptr, &stack, FROM_MALLOC);
53}
54
55ALLOCATION_FUNCTION_ATTRIBUTE
56void _free_dbg(void *ptr, int) {
57  free(ptr);
58}
59
60ALLOCATION_FUNCTION_ATTRIBUTE
61void _free_base(void *ptr) {
62  free(ptr);
63}
64
65ALLOCATION_FUNCTION_ATTRIBUTE
66void *malloc(size_t size) {
67  GET_STACK_TRACE_MALLOC;
68  return asan_malloc(size, &stack);
69}
70
71ALLOCATION_FUNCTION_ATTRIBUTE
72void *_malloc_base(size_t size) {
73  return malloc(size);
74}
75
76ALLOCATION_FUNCTION_ATTRIBUTE
77void *_malloc_dbg(size_t size, int, const char *, int) {
78  return malloc(size);
79}
80
81ALLOCATION_FUNCTION_ATTRIBUTE
82void *calloc(size_t nmemb, size_t size) {
83  GET_STACK_TRACE_MALLOC;
84  return asan_calloc(nmemb, size, &stack);
85}
86
87ALLOCATION_FUNCTION_ATTRIBUTE
88void *_calloc_base(size_t nmemb, size_t size) {
89  return calloc(nmemb, size);
90}
91
92ALLOCATION_FUNCTION_ATTRIBUTE
93void *_calloc_dbg(size_t nmemb, size_t size, int, const char *, int) {
94  return calloc(nmemb, size);
95}
96
97ALLOCATION_FUNCTION_ATTRIBUTE
98void *_calloc_impl(size_t nmemb, size_t size, int *errno_tmp) {
99  return calloc(nmemb, size);
100}
101
102ALLOCATION_FUNCTION_ATTRIBUTE
103void *realloc(void *ptr, size_t size) {
104  GET_STACK_TRACE_MALLOC;
105  return asan_realloc(ptr, size, &stack);
106}
107
108ALLOCATION_FUNCTION_ATTRIBUTE
109void *_realloc_dbg(void *ptr, size_t size, int) {
110  UNREACHABLE("_realloc_dbg should not exist!");
111  return 0;
112}
113
114ALLOCATION_FUNCTION_ATTRIBUTE
115void *_realloc_base(void *ptr, size_t size) {
116  return realloc(ptr, size);
117}
118
119ALLOCATION_FUNCTION_ATTRIBUTE
120void *_recalloc(void *p, size_t n, size_t elem_size) {
121  if (!p)
122    return calloc(n, elem_size);
123  const size_t size = n * elem_size;
124  if (elem_size != 0 && size / elem_size != n)
125    return 0;
126  return realloc(p, size);
127}
128
129ALLOCATION_FUNCTION_ATTRIBUTE
130void *_recalloc_base(void *p, size_t n, size_t elem_size) {
131  return _recalloc(p, n, elem_size);
132}
133
134ALLOCATION_FUNCTION_ATTRIBUTE
135size_t _msize(void *ptr) {
136  GET_CURRENT_PC_BP_SP;
137  (void)sp;
138  return asan_malloc_usable_size(ptr, pc, bp);
139}
140
141ALLOCATION_FUNCTION_ATTRIBUTE
142void *_expand(void *memblock, size_t size) {
143  // _expand is used in realloc-like functions to resize the buffer if possible.
144  // We don't want memory to stand still while resizing buffers, so return 0.
145  return 0;
146}
147
148ALLOCATION_FUNCTION_ATTRIBUTE
149void *_expand_dbg(void *memblock, size_t size) {
150  return _expand(memblock, size);
151}
152
153// TODO(timurrrr): Might want to add support for _aligned_* allocation
154// functions to detect a bit more bugs.  Those functions seem to wrap malloc().
155
156int _CrtDbgReport(int, const char*, int,
157                  const char*, const char*, ...) {
158  ShowStatsAndAbort();
159}
160
161int _CrtDbgReportW(int reportType, const wchar_t*, int,
162                   const wchar_t*, const wchar_t*, ...) {
163  ShowStatsAndAbort();
164}
165
166int _CrtSetReportMode(int, int) {
167  return 0;
168}
169}  // extern "C"
170
171INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags,
172                   SIZE_T dwBytes) {
173  GET_STACK_TRACE_MALLOC;
174  void *p = asan_malloc(dwBytes, &stack);
175  // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
176  // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
177  // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
178  if (dwFlags == HEAP_ZERO_MEMORY)
179    internal_memset(p, 0, asan_mz_size(p));
180  else
181    CHECK(dwFlags == 0 && "unsupported heap flags");
182  return p;
183}
184
185INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) {
186  CHECK(dwFlags == 0 && "unsupported heap flags");
187  GET_STACK_TRACE_FREE;
188  asan_free(lpMem, &stack, FROM_MALLOC);
189  return true;
190}
191
192INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags,
193                   LPVOID lpMem, SIZE_T dwBytes) {
194  GET_STACK_TRACE_MALLOC;
195  // Realloc should never reallocate in place.
196  if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY)
197    return nullptr;
198  CHECK(dwFlags == 0 && "unsupported heap flags");
199  return asan_realloc(lpMem, dwBytes, &stack);
200}
201
202INTERCEPTOR_WINAPI(SIZE_T, HeapSize, HANDLE hHeap, DWORD dwFlags,
203                   LPCVOID lpMem) {
204  CHECK(dwFlags == 0 && "unsupported heap flags");
205  GET_CURRENT_PC_BP_SP;
206  (void)sp;
207  return asan_malloc_usable_size(lpMem, pc, bp);
208}
209
210namespace __asan {
211
212static void TryToOverrideFunction(const char *fname, uptr new_func) {
213  // Failure here is not fatal. The CRT may not be present, and different CRT
214  // versions use different symbols.
215  if (!__interception::OverrideFunction(fname, new_func))
216    VPrintf(2, "Failed to override function %s\n", fname);
217}
218
219void ReplaceSystemMalloc() {
220#if defined(ASAN_DYNAMIC)
221  TryToOverrideFunction("free", (uptr)free);
222  TryToOverrideFunction("_free_base", (uptr)free);
223  TryToOverrideFunction("malloc", (uptr)malloc);
224  TryToOverrideFunction("_malloc_base", (uptr)malloc);
225  TryToOverrideFunction("_malloc_crt", (uptr)malloc);
226  TryToOverrideFunction("calloc", (uptr)calloc);
227  TryToOverrideFunction("_calloc_base", (uptr)calloc);
228  TryToOverrideFunction("_calloc_crt", (uptr)calloc);
229  TryToOverrideFunction("realloc", (uptr)realloc);
230  TryToOverrideFunction("_realloc_base", (uptr)realloc);
231  TryToOverrideFunction("_realloc_crt", (uptr)realloc);
232  TryToOverrideFunction("_recalloc", (uptr)_recalloc);
233  TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);
234  TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);
235  TryToOverrideFunction("_msize", (uptr)_msize);
236  TryToOverrideFunction("_expand", (uptr)_expand);
237  TryToOverrideFunction("_expand_base", (uptr)_expand);
238
239  // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which
240  // enable cross-module inlining. This means our _malloc_base hook won't catch
241  // all CRT allocations. This code here patches the import table of
242  // ucrtbase.dll so that all attempts to use the lower-level win32 heap
243  // allocation API will be directed to ASan's heap. We don't currently
244  // intercept all calls to HeapAlloc. If we did, we would have to check on
245  // HeapFree whether the pointer came from ASan of from the system.
246#define INTERCEPT_UCRT_FUNCTION(func)                                         \
247  if (!INTERCEPT_FUNCTION_DLLIMPORT("ucrtbase.dll",                           \
248                                    "api-ms-win-core-heap-l1-1-0.dll", func)) \
249    VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func);
250  INTERCEPT_UCRT_FUNCTION(HeapAlloc);
251  INTERCEPT_UCRT_FUNCTION(HeapFree);
252  INTERCEPT_UCRT_FUNCTION(HeapReAlloc);
253  INTERCEPT_UCRT_FUNCTION(HeapSize);
254#undef INTERCEPT_UCRT_FUNCTION
255#endif
256}
257}  // namespace __asan
258
259#endif  // _WIN32
260