1 //===-- asan_malloc_win.cc ------------------------------------------------===//
2 //
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
5 //
6 //===----------------------------------------------------------------------===//
7 //
8 // This file is a part of AddressSanitizer, an address sanity checker.
9 //
10 // Windows-specific malloc interception.
11 //===----------------------------------------------------------------------===//
12
13 #include "sanitizer_common/sanitizer_platform.h"
14 #if SANITIZER_WINDOWS
15 // Intentionally not including windows.h here, to avoid the risk of
16 // pulling in conflicting declarations of these functions. (With mingw-w64,
17 // there's a risk of windows.h pulling in stdint.h.)
18 typedef int BOOL;
19 typedef void *HANDLE;
20 typedef const void *LPCVOID;
21 typedef void *LPVOID;
22
23 #define HEAP_ZERO_MEMORY 0x00000008
24 #define HEAP_REALLOC_IN_PLACE_ONLY 0x00000010
25
26
27 #include "asan_allocator.h"
28 #include "asan_interceptors.h"
29 #include "asan_internal.h"
30 #include "asan_stack.h"
31 #include "interception/interception.h"
32
33 #include <stddef.h>
34
35 using namespace __asan; // NOLINT
36
37 // MT: Simply defining functions with the same signature in *.obj
38 // files overrides the standard functions in the CRT.
39 // MD: Memory allocation functions are defined in the CRT .dll,
40 // so we have to intercept them before they are called for the first time.
41
42 #if ASAN_DYNAMIC
43 # define ALLOCATION_FUNCTION_ATTRIBUTE
44 #else
45 # define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
46 #endif
47
48 extern "C" {
49 ALLOCATION_FUNCTION_ATTRIBUTE
free(void * ptr)50 void free(void *ptr) {
51 GET_STACK_TRACE_FREE;
52 return asan_free(ptr, &stack, FROM_MALLOC);
53 }
54
55 ALLOCATION_FUNCTION_ATTRIBUTE
_free_dbg(void * ptr,int)56 void _free_dbg(void *ptr, int) {
57 free(ptr);
58 }
59
60 ALLOCATION_FUNCTION_ATTRIBUTE
_free_base(void * ptr)61 void _free_base(void *ptr) {
62 free(ptr);
63 }
64
65 ALLOCATION_FUNCTION_ATTRIBUTE
malloc(size_t size)66 void *malloc(size_t size) {
67 GET_STACK_TRACE_MALLOC;
68 return asan_malloc(size, &stack);
69 }
70
71 ALLOCATION_FUNCTION_ATTRIBUTE
_malloc_base(size_t size)72 void *_malloc_base(size_t size) {
73 return malloc(size);
74 }
75
76 ALLOCATION_FUNCTION_ATTRIBUTE
_malloc_dbg(size_t size,int,const char *,int)77 void *_malloc_dbg(size_t size, int, const char *, int) {
78 return malloc(size);
79 }
80
81 ALLOCATION_FUNCTION_ATTRIBUTE
calloc(size_t nmemb,size_t size)82 void *calloc(size_t nmemb, size_t size) {
83 GET_STACK_TRACE_MALLOC;
84 return asan_calloc(nmemb, size, &stack);
85 }
86
87 ALLOCATION_FUNCTION_ATTRIBUTE
_calloc_base(size_t nmemb,size_t size)88 void *_calloc_base(size_t nmemb, size_t size) {
89 return calloc(nmemb, size);
90 }
91
92 ALLOCATION_FUNCTION_ATTRIBUTE
_calloc_dbg(size_t nmemb,size_t size,int,const char *,int)93 void *_calloc_dbg(size_t nmemb, size_t size, int, const char *, int) {
94 return calloc(nmemb, size);
95 }
96
97 ALLOCATION_FUNCTION_ATTRIBUTE
_calloc_impl(size_t nmemb,size_t size,int * errno_tmp)98 void *_calloc_impl(size_t nmemb, size_t size, int *errno_tmp) {
99 return calloc(nmemb, size);
100 }
101
102 ALLOCATION_FUNCTION_ATTRIBUTE
realloc(void * ptr,size_t size)103 void *realloc(void *ptr, size_t size) {
104 GET_STACK_TRACE_MALLOC;
105 return asan_realloc(ptr, size, &stack);
106 }
107
108 ALLOCATION_FUNCTION_ATTRIBUTE
_realloc_dbg(void * ptr,size_t size,int)109 void *_realloc_dbg(void *ptr, size_t size, int) {
110 UNREACHABLE("_realloc_dbg should not exist!");
111 return 0;
112 }
113
114 ALLOCATION_FUNCTION_ATTRIBUTE
_realloc_base(void * ptr,size_t size)115 void *_realloc_base(void *ptr, size_t size) {
116 return realloc(ptr, size);
117 }
118
119 ALLOCATION_FUNCTION_ATTRIBUTE
_recalloc(void * p,size_t n,size_t elem_size)120 void *_recalloc(void *p, size_t n, size_t elem_size) {
121 if (!p)
122 return calloc(n, elem_size);
123 const size_t size = n * elem_size;
124 if (elem_size != 0 && size / elem_size != n)
125 return 0;
126 return realloc(p, size);
127 }
128
129 ALLOCATION_FUNCTION_ATTRIBUTE
_recalloc_base(void * p,size_t n,size_t elem_size)130 void *_recalloc_base(void *p, size_t n, size_t elem_size) {
131 return _recalloc(p, n, elem_size);
132 }
133
134 ALLOCATION_FUNCTION_ATTRIBUTE
_msize(void * ptr)135 size_t _msize(void *ptr) {
136 GET_CURRENT_PC_BP_SP;
137 (void)sp;
138 return asan_malloc_usable_size(ptr, pc, bp);
139 }
140
141 ALLOCATION_FUNCTION_ATTRIBUTE
_expand(void * memblock,size_t size)142 void *_expand(void *memblock, size_t size) {
143 // _expand is used in realloc-like functions to resize the buffer if possible.
144 // We don't want memory to stand still while resizing buffers, so return 0.
145 return 0;
146 }
147
148 ALLOCATION_FUNCTION_ATTRIBUTE
_expand_dbg(void * memblock,size_t size)149 void *_expand_dbg(void *memblock, size_t size) {
150 return _expand(memblock, size);
151 }
152
153 // TODO(timurrrr): Might want to add support for _aligned_* allocation
154 // functions to detect a bit more bugs. Those functions seem to wrap malloc().
155
_CrtDbgReport(int,const char *,int,const char *,const char *,...)156 int _CrtDbgReport(int, const char*, int,
157 const char*, const char*, ...) {
158 ShowStatsAndAbort();
159 }
160
_CrtDbgReportW(int reportType,const wchar_t *,int,const wchar_t *,const wchar_t *,...)161 int _CrtDbgReportW(int reportType, const wchar_t*, int,
162 const wchar_t*, const wchar_t*, ...) {
163 ShowStatsAndAbort();
164 }
165
_CrtSetReportMode(int,int)166 int _CrtSetReportMode(int, int) {
167 return 0;
168 }
169 } // extern "C"
170
INTERCEPTOR_WINAPI(LPVOID,HeapAlloc,HANDLE hHeap,DWORD dwFlags,SIZE_T dwBytes)171 INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags,
172 SIZE_T dwBytes) {
173 GET_STACK_TRACE_MALLOC;
174 void *p = asan_malloc(dwBytes, &stack);
175 // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
176 // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
177 // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
178 if (dwFlags == HEAP_ZERO_MEMORY)
179 internal_memset(p, 0, asan_mz_size(p));
180 else
181 CHECK(dwFlags == 0 && "unsupported heap flags");
182 return p;
183 }
184
INTERCEPTOR_WINAPI(BOOL,HeapFree,HANDLE hHeap,DWORD dwFlags,LPVOID lpMem)185 INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) {
186 CHECK(dwFlags == 0 && "unsupported heap flags");
187 GET_STACK_TRACE_FREE;
188 asan_free(lpMem, &stack, FROM_MALLOC);
189 return true;
190 }
191
INTERCEPTOR_WINAPI(LPVOID,HeapReAlloc,HANDLE hHeap,DWORD dwFlags,LPVOID lpMem,SIZE_T dwBytes)192 INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags,
193 LPVOID lpMem, SIZE_T dwBytes) {
194 GET_STACK_TRACE_MALLOC;
195 // Realloc should never reallocate in place.
196 if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY)
197 return nullptr;
198 CHECK(dwFlags == 0 && "unsupported heap flags");
199 return asan_realloc(lpMem, dwBytes, &stack);
200 }
201
INTERCEPTOR_WINAPI(SIZE_T,HeapSize,HANDLE hHeap,DWORD dwFlags,LPCVOID lpMem)202 INTERCEPTOR_WINAPI(SIZE_T, HeapSize, HANDLE hHeap, DWORD dwFlags,
203 LPCVOID lpMem) {
204 CHECK(dwFlags == 0 && "unsupported heap flags");
205 GET_CURRENT_PC_BP_SP;
206 (void)sp;
207 return asan_malloc_usable_size(lpMem, pc, bp);
208 }
209
210 namespace __asan {
211
TryToOverrideFunction(const char * fname,uptr new_func)212 static void TryToOverrideFunction(const char *fname, uptr new_func) {
213 // Failure here is not fatal. The CRT may not be present, and different CRT
214 // versions use different symbols.
215 if (!__interception::OverrideFunction(fname, new_func))
216 VPrintf(2, "Failed to override function %s\n", fname);
217 }
218
ReplaceSystemMalloc()219 void ReplaceSystemMalloc() {
220 #if defined(ASAN_DYNAMIC)
221 TryToOverrideFunction("free", (uptr)free);
222 TryToOverrideFunction("_free_base", (uptr)free);
223 TryToOverrideFunction("malloc", (uptr)malloc);
224 TryToOverrideFunction("_malloc_base", (uptr)malloc);
225 TryToOverrideFunction("_malloc_crt", (uptr)malloc);
226 TryToOverrideFunction("calloc", (uptr)calloc);
227 TryToOverrideFunction("_calloc_base", (uptr)calloc);
228 TryToOverrideFunction("_calloc_crt", (uptr)calloc);
229 TryToOverrideFunction("realloc", (uptr)realloc);
230 TryToOverrideFunction("_realloc_base", (uptr)realloc);
231 TryToOverrideFunction("_realloc_crt", (uptr)realloc);
232 TryToOverrideFunction("_recalloc", (uptr)_recalloc);
233 TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);
234 TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);
235 TryToOverrideFunction("_msize", (uptr)_msize);
236 TryToOverrideFunction("_expand", (uptr)_expand);
237 TryToOverrideFunction("_expand_base", (uptr)_expand);
238
239 // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which
240 // enable cross-module inlining. This means our _malloc_base hook won't catch
241 // all CRT allocations. This code here patches the import table of
242 // ucrtbase.dll so that all attempts to use the lower-level win32 heap
243 // allocation API will be directed to ASan's heap. We don't currently
244 // intercept all calls to HeapAlloc. If we did, we would have to check on
245 // HeapFree whether the pointer came from ASan of from the system.
246 #define INTERCEPT_UCRT_FUNCTION(func) \
247 if (!INTERCEPT_FUNCTION_DLLIMPORT("ucrtbase.dll", \
248 "api-ms-win-core-heap-l1-1-0.dll", func)) \
249 VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func);
250 INTERCEPT_UCRT_FUNCTION(HeapAlloc);
251 INTERCEPT_UCRT_FUNCTION(HeapFree);
252 INTERCEPT_UCRT_FUNCTION(HeapReAlloc);
253 INTERCEPT_UCRT_FUNCTION(HeapSize);
254 #undef INTERCEPT_UCRT_FUNCTION
255 #endif
256 }
257 } // namespace __asan
258
259 #endif // _WIN32
260