1 //===-- asan_malloc_win.cc ------------------------------------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file is a part of AddressSanitizer, an address sanity checker.
12 // Windows-specific malloc interception.
13 //===----------------------------------------------------------------------===//
15 #include "sanitizer_common/sanitizer_platform.h"
17 #define WIN32_LEAN_AND_MEAN
20 #include "asan_allocator.h"
21 #include "asan_interceptors.h"
22 #include "asan_internal.h"
23 #include "asan_stack.h"
24 #include "interception/interception.h"
28 using namespace __asan; // NOLINT
30 // MT: Simply defining functions with the same signature in *.obj
31 // files overrides the standard functions in the CRT.
32 // MD: Memory allocation functions are defined in the CRT .dll,
33 // so we have to intercept them before they are called for the first time.
36 # define ALLOCATION_FUNCTION_ATTRIBUTE
38 # define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
42 ALLOCATION_FUNCTION_ATTRIBUTE
43 void free(void *ptr) {
45 return asan_free(ptr, &stack, FROM_MALLOC);
48 ALLOCATION_FUNCTION_ATTRIBUTE
49 void _free_dbg(void *ptr, int) {
53 ALLOCATION_FUNCTION_ATTRIBUTE
54 void _free_base(void *ptr) {
58 ALLOCATION_FUNCTION_ATTRIBUTE
59 void *malloc(size_t size) {
60 GET_STACK_TRACE_MALLOC;
61 return asan_malloc(size, &stack);
64 ALLOCATION_FUNCTION_ATTRIBUTE
65 void *_malloc_base(size_t size) {
69 ALLOCATION_FUNCTION_ATTRIBUTE
70 void *_malloc_dbg(size_t size, int, const char *, int) {
74 ALLOCATION_FUNCTION_ATTRIBUTE
75 void *calloc(size_t nmemb, size_t size) {
76 GET_STACK_TRACE_MALLOC;
77 return asan_calloc(nmemb, size, &stack);
80 ALLOCATION_FUNCTION_ATTRIBUTE
81 void *_calloc_base(size_t nmemb, size_t size) {
82 return calloc(nmemb, size);
85 ALLOCATION_FUNCTION_ATTRIBUTE
86 void *_calloc_dbg(size_t nmemb, size_t size, int, const char *, int) {
87 return calloc(nmemb, size);
90 ALLOCATION_FUNCTION_ATTRIBUTE
91 void *_calloc_impl(size_t nmemb, size_t size, int *errno_tmp) {
92 return calloc(nmemb, size);
95 ALLOCATION_FUNCTION_ATTRIBUTE
96 void *realloc(void *ptr, size_t size) {
97 GET_STACK_TRACE_MALLOC;
98 return asan_realloc(ptr, size, &stack);
101 ALLOCATION_FUNCTION_ATTRIBUTE
102 void *_realloc_dbg(void *ptr, size_t size, int) {
103 CHECK(!"_realloc_dbg should not exist!");
107 ALLOCATION_FUNCTION_ATTRIBUTE
108 void *_realloc_base(void *ptr, size_t size) {
109 return realloc(ptr, size);
112 ALLOCATION_FUNCTION_ATTRIBUTE
113 void *_recalloc(void *p, size_t n, size_t elem_size) {
115 return calloc(n, elem_size);
116 const size_t size = n * elem_size;
117 if (elem_size != 0 && size / elem_size != n)
119 return realloc(p, size);
122 ALLOCATION_FUNCTION_ATTRIBUTE
123 void *_recalloc_base(void *p, size_t n, size_t elem_size) {
124 return _recalloc(p, n, elem_size);
127 ALLOCATION_FUNCTION_ATTRIBUTE
128 size_t _msize(const void *ptr) {
129 GET_CURRENT_PC_BP_SP;
131 return asan_malloc_usable_size(ptr, pc, bp);
134 ALLOCATION_FUNCTION_ATTRIBUTE
135 void *_expand(void *memblock, size_t size) {
136 // _expand is used in realloc-like functions to resize the buffer if possible.
137 // We don't want memory to stand still while resizing buffers, so return 0.
141 ALLOCATION_FUNCTION_ATTRIBUTE
142 void *_expand_dbg(void *memblock, size_t size) {
143 return _expand(memblock, size);
146 // TODO(timurrrr): Might want to add support for _aligned_* allocation
147 // functions to detect a bit more bugs. Those functions seem to wrap malloc().
149 int _CrtDbgReport(int, const char*, int,
150 const char*, const char*, ...) {
154 int _CrtDbgReportW(int reportType, const wchar_t*, int,
155 const wchar_t*, const wchar_t*, ...) {
159 int _CrtSetReportMode(int, int) {
164 INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags,
166 GET_STACK_TRACE_MALLOC;
167 void *p = asan_malloc(dwBytes, &stack);
168 // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
169 // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
170 // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
171 if (dwFlags == HEAP_ZERO_MEMORY)
172 internal_memset(p, 0, asan_mz_size(p));
174 CHECK(dwFlags == 0 && "unsupported heap flags");
178 INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) {
179 CHECK(dwFlags == 0 && "unsupported heap flags");
180 GET_STACK_TRACE_FREE;
181 asan_free(lpMem, &stack, FROM_MALLOC);
185 INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags,
186 LPVOID lpMem, SIZE_T dwBytes) {
187 GET_STACK_TRACE_MALLOC;
188 // Realloc should never reallocate in place.
189 if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY)
191 CHECK(dwFlags == 0 && "unsupported heap flags");
192 return asan_realloc(lpMem, dwBytes, &stack);
195 INTERCEPTOR_WINAPI(SIZE_T, HeapSize, HANDLE hHeap, DWORD dwFlags,
197 CHECK(dwFlags == 0 && "unsupported heap flags");
198 GET_CURRENT_PC_BP_SP;
200 return asan_malloc_usable_size(lpMem, pc, bp);
205 static void TryToOverrideFunction(const char *fname, uptr new_func) {
206 // Failure here is not fatal. The CRT may not be present, and different CRT
207 // versions use different symbols.
208 if (!__interception::OverrideFunction(fname, new_func))
209 VPrintf(2, "Failed to override function %s\n", fname);
212 void ReplaceSystemMalloc() {
213 #if defined(ASAN_DYNAMIC)
214 TryToOverrideFunction("free", (uptr)free);
215 TryToOverrideFunction("_free_base", (uptr)free);
216 TryToOverrideFunction("malloc", (uptr)malloc);
217 TryToOverrideFunction("_malloc_base", (uptr)malloc);
218 TryToOverrideFunction("_malloc_crt", (uptr)malloc);
219 TryToOverrideFunction("calloc", (uptr)calloc);
220 TryToOverrideFunction("_calloc_base", (uptr)calloc);
221 TryToOverrideFunction("_calloc_crt", (uptr)calloc);
222 TryToOverrideFunction("realloc", (uptr)realloc);
223 TryToOverrideFunction("_realloc_base", (uptr)realloc);
224 TryToOverrideFunction("_realloc_crt", (uptr)realloc);
225 TryToOverrideFunction("_recalloc", (uptr)_recalloc);
226 TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);
227 TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);
228 TryToOverrideFunction("_msize", (uptr)_msize);
229 TryToOverrideFunction("_expand", (uptr)_expand);
230 TryToOverrideFunction("_expand_base", (uptr)_expand);
232 // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which
233 // enable cross-module inlining. This means our _malloc_base hook won't catch
234 // all CRT allocations. This code here patches the import table of
235 // ucrtbase.dll so that all attempts to use the lower-level win32 heap
236 // allocation API will be directed to ASan's heap. We don't currently
237 // intercept all calls to HeapAlloc. If we did, we would have to check on
238 // HeapFree whether the pointer came from ASan of from the system.
239 #define INTERCEPT_UCRT_FUNCTION(func) \
240 if (!INTERCEPT_FUNCTION_DLLIMPORT("ucrtbase.dll", \
241 "api-ms-win-core-heap-l1-1-0.dll", func)) \
242 VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func);
243 INTERCEPT_UCRT_FUNCTION(HeapAlloc);
244 INTERCEPT_UCRT_FUNCTION(HeapFree);
245 INTERCEPT_UCRT_FUNCTION(HeapReAlloc);
246 INTERCEPT_UCRT_FUNCTION(HeapSize);
247 #undef INTERCEPT_UCRT_FUNCTION
250 } // namespace __asan