RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-25 14:07:46 +00:00
Code Issues Activity Actions

UserspaceEmulator: Include malloc/free backtraces in UAF logs :^)

Browse source 
When catching a use-after-free, we now also print out the backtraces
for where the memory was allocated, and for where it was freed.

This will be extremely helpful for debugging.
This commit is contained in:
Andreas Kling 2020-07-16 17:23:39 +02:00
parent dd68370efc
commit 1dcc21d32e
1 changed files with 8 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

10
DevTools/UserspaceEmulator/MallocTracer.cpp
View file

@ -101,8 +101,11 @@ void MallocTracer::audit_read(FlatPtr address, size_t size)
if (mallocation->freed) { if (mallocation->freed) {
dbgprintf("\n"); dbgprintf("\n");
dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte read at address %p\n", s_pid, size, address); dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte read at address %p\n", s_pid, size, address);
dbgprintf("==%d== Address is %zu bytes into freed block of size %zu\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(); Emulator::the().dump_backtrace();
dbgprintf("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
dbgprintf("==%d== Later freed at:\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(mallocation->free_backtrace);
return; return;
} }
} }
@ -124,8 +127,11 @@ void MallocTracer::audit_write(FlatPtr address, size_t size)
if (mallocation->freed) { if (mallocation->freed) {
dbgprintf("\n"); dbgprintf("\n");
dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte write at address %p\n", s_pid, size, address); dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte write at address %p\n", s_pid, size, address);
dbgprintf("==%d== Address is %zu bytes into freed block of size %zu\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(); Emulator::the().dump_backtrace();
dbgprintf("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
dbgprintf("==%d== Later freed at:\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(mallocation->free_backtrace);
return; return;
} }
} }