mirror of
https://github.com/RGBCube/serenity
synced 2025-07-25 23:07:35 +00:00
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^)
This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
This commit is contained in:
parent
d7c87e84f3
commit
c314292319
9 changed files with 274 additions and 5 deletions
|
@ -51,6 +51,8 @@ public:
|
|||
bool is_writable() const { return m_prot & PROT_WRITE; }
|
||||
bool is_executable() const { return m_prot & PROT_EXEC; }
|
||||
|
||||
bool is_malloc_block() const;
|
||||
|
||||
private:
|
||||
MmapRegion(u32 base, u32 size, int prot);
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue