mirror of
https://github.com/RGBCube/serenity
synced 2025-07-24 15:27:42 +00:00
UserspaceEmulator: Include malloc/free backtraces in UAF logs :^)
When catching a use-after-free, we now also print out the backtraces for where the memory was allocated, and for where it was freed. This will be extremely helpful for debugging.
This commit is contained in:
parent
dd68370efc
commit
1dcc21d32e
1 changed files with 8 additions and 2 deletions
|
@ -101,8 +101,11 @@ void MallocTracer::audit_read(FlatPtr address, size_t size)
|
||||||
if (mallocation->freed) {
|
if (mallocation->freed) {
|
||||||
dbgprintf("\n");
|
dbgprintf("\n");
|
||||||
dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte read at address %p\n", s_pid, size, address);
|
dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte read at address %p\n", s_pid, size, address);
|
||||||
dbgprintf("==%d== Address is %zu bytes into freed block of size %zu\n", s_pid, offset_into_mallocation, mallocation->size);
|
|
||||||
Emulator::the().dump_backtrace();
|
Emulator::the().dump_backtrace();
|
||||||
|
dbgprintf("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", s_pid, offset_into_mallocation, mallocation->size);
|
||||||
|
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
|
||||||
|
dbgprintf("==%d== Later freed at:\n", s_pid, offset_into_mallocation, mallocation->size);
|
||||||
|
Emulator::the().dump_backtrace(mallocation->free_backtrace);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -124,8 +127,11 @@ void MallocTracer::audit_write(FlatPtr address, size_t size)
|
||||||
if (mallocation->freed) {
|
if (mallocation->freed) {
|
||||||
dbgprintf("\n");
|
dbgprintf("\n");
|
||||||
dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte write at address %p\n", s_pid, size, address);
|
dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte write at address %p\n", s_pid, size, address);
|
||||||
dbgprintf("==%d== Address is %zu bytes into freed block of size %zu\n", s_pid, offset_into_mallocation, mallocation->size);
|
|
||||||
Emulator::the().dump_backtrace();
|
Emulator::the().dump_backtrace();
|
||||||
|
dbgprintf("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", s_pid, offset_into_mallocation, mallocation->size);
|
||||||
|
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
|
||||||
|
dbgprintf("==%d== Later freed at:\n", s_pid, offset_into_mallocation, mallocation->size);
|
||||||
|
Emulator::the().dump_backtrace(mallocation->free_backtrace);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue