Index: trunk/src/dnmalloc.c =================================================================== --- trunk/src/dnmalloc.c (revision 171) +++ trunk/src/dnmalloc.c (revision 172) @@ -1,4 +1,6 @@ /* DistriNet malloc (dnmalloc): a more secure memory allocator. - Copyright (C) 2005, Yves Younan, Wouter Joosen, Frank Piessens and Rainer Wichmann + Copyright (C) 2005, Yves Younan, Wouter Joosen, Frank Piessens + and Rainer Wichmann + The authors can be contacted by: Email: dnmalloc@fort-knox.org @@ -25,5 +27,5 @@ */ -/* Current version: dnmalloc 1.0 */ +/* Current version: dnmalloc 1.0 */ /* Includes arc4random from OpenBSD, which is under the BDS license */ @@ -93,4 +95,10 @@ works on OpenBSD. + further to 1.0: + Valgrind client requests inserted (#define USE_VALGRIND) + Fix malloc_consolidate (nextchunk->fd, nextchunk->bck may be NULL) + Portability: minsize = 32 bit on 64bit architecture + Minor cleanups + There may be some bugs left in this version. please use with caution. */ @@ -176,4 +184,18 @@ #endif +#ifdef USE_VALGRIND +#include +#else +#define VALGRIND_FREELIKE_BLOCK(a,b) ((void)0) +#define VALGRIND_MALLOCLIKE_BLOCK(a,b,c,d) ((void)0) +#define VALGRIND_CREATE_MEMPOOL(a,b,c) ((void)0) +#define VALGRIND_MEMPOOL_ALLOC(a,b,c) ((void)0) +#define VALGRIND_MEMPOOL_FREE(a,b) ((void)0) +#define VALGRIND_DESTROY_MEMPOOL(a) ((void)0) +#define VALGRIND_MAKE_MEM_DEFINED(a,b) ((void)0) +#define VALGRIND_MAKE_MEM_UNDEFINED(a,b) ((void)0) +#define VALGRIND_MAKE_MEM_NOACCESS(a,b) ((void)0) +#endif + #if defined (__GNUC__) && __GNUC__ > 2 # define LIKELY(expression) (__builtin_expect(!!(expression), 1)) @@ -277,5 +299,4 @@ #endif -#if !defined(SAMHAIN) static void default_assert_handler(const char *error, const char *file, int line) @@ -300,12 +321,9 @@ fputc('\n', stderr); #endif + (void) line; abort(); } static assert_handler_tp *assert_handler = default_assert_handler; -#else -extern void safe_fatal(const char *error, - const char *file, int line); -static assert_handler_tp *assert_handler = safe_fatal; -#endif + #define assert(x) \ @@ -337,5 +355,5 @@ /* #define DNMALLOC_DEBUG */ - /* Do some extra checks? */ + /* Do some extra checks? if not, covered by assrt()s */ /* #define DNMALLOC_CHECKS */ @@ -668,9 +686,5 @@ #ifndef HAVE_MMAP -# ifdef SAMHAIN -# error mmap not available, use --disable-dnmalloc -# else -# error HAVE_MMAP not defined, has your operating system mmap? -# endif +# error HAVE_MMAP not defined, has your operating system mmap? #endif @@ -1898,4 +1912,5 @@ guard_set_p = (char*)(chunk(P)); \ guard_set_p += request; \ + VALGRIND_MAKE_MEM_UNDEFINED(guard_set_p,GUARD_SIZE); \ guard_set_q = (char*)(guard); \ *guard_set_p = *guard_set_q; ++guard_set_p; ++guard_set_q; \ @@ -1903,8 +1918,11 @@ *guard_set_p = *guard_set_q; ++guard_set_p; ++guard_set_q; \ *guard_set_p = *guard_set_q; \ + VALGRIND_MAKE_MEM_NOACCESS((((char*)chunk(P))+request),GUARD_SIZE); \ (P)->req = request #define guard_check(guard, P) \ - assert(0 == memcmp((((char *)chunk(P))+(P)->req),(void*)(guard),GUARD_SIZE)); + VALGRIND_MAKE_MEM_DEFINED((((char *)chunk(P))+(P)->req), GUARD_SIZE); \ + assert(0 == memcmp((((char *)chunk(P))+(P)->req),(void*)(guard),GUARD_SIZE));\ + VALGRIND_MAKE_MEM_NOACCESS((((char *)chunk(P))+(P)->req), GUARD_SIZE); #else @@ -2164,13 +2182,6 @@ /* #define FIRST_SORTED_BIN_SIZE 65536 */ -/* 12288 1m59 1m58 1m58 - * 2560 1m56 1m59 1m57 - * MIN_LARGE_SIZE 2m01 1m56 1m57 - */ -#ifdef SAMHAIN -#define FIRST_SORTED_BIN_SIZE 2560 -#else #define FIRST_SORTED_BIN_SIZE MIN_LARGE_SIZE -#endif + /* @@ -2372,5 +2383,11 @@ /* Minimum size of a chunk */ -#define MINCHUNKSIZE 16 + +#if (SIZEOF_UNSIGNED_LONG == 8) || defined(__arch64__) || defined(__ia64__) || defined(__x86_64__) || defined(__LP64__) || defined(__64BIT__) || defined(_LP64) || defined(_M_IA64) || (defined(_MIPS_SZLONG) && (_MIPS_SZLONG == 64)) +# define MINCHUNKSIZE 32 +#else +# define MINCHUNKSIZE 16 +#endif + /* The amount of hashtable entries for each page: @@ -2542,4 +2559,5 @@ firstciinfo = currciinfo; totalcictr++; + VALGRIND_CREATE_MEMPOOL(newcireg, 0, 0); } @@ -2567,16 +2585,19 @@ if (freelst) { - freeci = freelst; - newciinfo->freelist = freelst->fd; - newciinfo->freecounter--; - /* memset(freeci, 0, sizeof(struct chunkinfo)); */ - freeci->prev_size = 0; - freeci->size = 0; - freeci->req = 0; - freeci->hash_next = NULL; - freeci->fd = NULL; - freeci->bk = NULL; - freeci->chunk = NULL; - return (freeci); + freeci = freelst; + newciinfo->freecounter--; + newciinfo->freelist = freelst->fd; + + VALGRIND_MEMPOOL_ALLOC((char*)currciinfo, (char*)freeci, + sizeof(struct chunkinfo)); + + freeci->prev_size = 0; + freeci->size = 0; + freeci->req = 0; + freeci->hash_next = NULL; + freeci->fd = NULL; + freeci->bk = NULL; + freeci->chunk = NULL; + return (freeci); } else @@ -2591,4 +2612,8 @@ currciinfo->freecounter--; currciinfo->position++; + + VALGRIND_MEMPOOL_ALLOC((char*)currciinfo, (char*)freeci, + sizeof(struct chunkinfo)); + return (freeci); } @@ -2600,4 +2625,5 @@ struct cireginfo *prevciinfo = firstciinfo; void *unmapme; + while (newciinfo && newciinfo != freeme) { prevciinfo = newciinfo; @@ -2609,4 +2635,5 @@ prevciinfo->next = newciinfo->next; unmapme = (void *) ((char*)freeme - PGSIZE); + VALGRIND_DESTROY_MEMPOOL((char*)freeme); #if PARANOIA > 1 munmap(unmapme, CIREGSIZE+(2*PGSIZE)); @@ -2620,4 +2647,5 @@ struct cireginfo *newciinfo; + newciinfo = currciinfo; if (((chunkinfoptr) newciinfo < p) && (p < (chunkinfoptr) (newciinfo+NUMBER_FREE_CHUNKS))) { @@ -2625,4 +2653,10 @@ newciinfo->freelist = p; newciinfo->freecounter++; + VALGRIND_MEMPOOL_FREE((char*)newciinfo, (char*)p); + VALGRIND_MAKE_MEM_DEFINED(p,sizeof(struct chunkinfo)); + VALGRIND_MAKE_MEM_NOACCESS(p->size, sizeof(INTERNAL_SIZE_T)); + VALGRIND_MAKE_MEM_NOACCESS(p->req, sizeof(INTERNAL_SIZE_T)); + VALGRIND_MAKE_MEM_NOACCESS(p->bk, sizeof(struct chunkinfo*)); + VALGRIND_MAKE_MEM_NOACCESS(p->chunk, sizeof(mchunkptr)); } else { newciinfo = firstciinfo; @@ -2633,4 +2667,10 @@ newciinfo->freelist = p; newciinfo->freecounter++; + VALGRIND_MEMPOOL_FREE((char*)newciinfo, (char*)p); + VALGRIND_MAKE_MEM_DEFINED(p,sizeof(struct chunkinfo)); + VALGRIND_MAKE_MEM_NOACCESS(p->size, sizeof(INTERNAL_SIZE_T)); + VALGRIND_MAKE_MEM_NOACCESS(p->req, sizeof(INTERNAL_SIZE_T)); + VALGRIND_MAKE_MEM_NOACCESS(p->bk, sizeof(struct chunkinfo*)); + VALGRIND_MAKE_MEM_NOACCESS(p->chunk, sizeof(mchunkptr)); if (UNLIKELY(newciinfo->freecounter == NUMBER_FREE_CHUNKS)) freeciregion(newciinfo); @@ -2738,4 +2778,5 @@ } else { + ci_insert->hash_next = ci_orig->hash_next; ci_orig->hash_next = ci_insert; @@ -2797,5 +2838,7 @@ } -/* mmapped chunks are multiples of pagesize, no hash_nexts, just remove from the hashtable */ +/* mmapped chunks are multiples of pagesize, no hash_nexts, + * just remove from the hashtable + */ #define hashtable_remove_mmapped(p) hashtable[hash(p)] = 0; @@ -2807,5 +2850,5 @@ #ifdef DNMALLOC_DEBUG - fprintf(stderr, "hashtable_ski: %p, %lu\n", chunk(ci_todelete), hash(chunk(ci_todelete))); + fprintf(stderr, "hashtable_skiprm: %p, %lu\n", chunk(ci_todelete), hash(chunk(ci_todelete))); #endif @@ -3260,4 +3303,5 @@ if (have_fastchunks(av)) { + Void_t * retval; assert(in_smallbin_range(nb)); malloc_consolidate(av); @@ -3265,5 +3309,7 @@ fprintf(stderr, "Return sysmalloc have_fastchunks\n"); #endif - return mALLOc(nb - MALLOC_ALIGN_MASK); + retval = mALLOc(nb - MALLOC_ALIGN_MASK); + VALGRIND_FREELIKE_BLOCK(retval, 0); + return retval; } @@ -3296,4 +3342,6 @@ if (mm != (char*)(MORECORE_FAILURE)) { + VALGRIND_MAKE_MEM_NOACCESS(mm,size); + /* The offset to the start of the mmapped region is stored @@ -3404,4 +3452,5 @@ if (brk != (char*)(MORECORE_FAILURE)) { av->sbrked_mem += size; + VALGRIND_MAKE_MEM_NOACCESS(brk,size); } @@ -3430,4 +3479,6 @@ if (brk != (char*)(MORECORE_FAILURE)) { + VALGRIND_MAKE_MEM_NOACCESS(brk,size); + av->mmapped_mem += size; #ifdef DNMALLOC_DEBUG @@ -3574,4 +3625,7 @@ set_noncontiguous(av); } + else { + VALGRIND_MAKE_MEM_NOACCESS(snd_brk,correction); + } } @@ -3673,4 +3727,5 @@ set_head(old_top, old_size | PREV_INUSE | INUSE); guard_set(av->guard_stored, old_top, 0, old_size); + VALGRIND_MALLOCLIKE_BLOCK(chunk(old_top), old_size, 0, 0); fREe(chunk(old_top)); av->trim_threshold = tt; @@ -3885,4 +3940,5 @@ check_remalloced_chunk(victim, nb); guard_set(av->guard_stored, victim, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(victim), bytes, 0, 0); return chunk(victim); } @@ -3910,4 +3966,5 @@ check_malloced_chunk(victim, nb); guard_set(av->guard_stored, victim, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(victim), bytes, 0, 0); return chunk(victim); } @@ -3970,4 +4027,5 @@ check_malloced_chunk(victim, nb); guard_set(av->guard_stored, victim, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(victim), bytes, 0, 0); return chunk(victim); } @@ -3983,4 +4041,5 @@ check_malloced_chunk(victim, nb); guard_set(av->guard_stored, victim, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(victim), bytes, 0, 0); return chunk(victim); } @@ -4058,4 +4117,5 @@ check_malloced_chunk(victim, nb); guard_set(av->guard_stored, victim, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(victim), bytes, 0, 0); return chunk(victim); } @@ -4065,4 +4125,5 @@ check_malloced_chunk(victim, nb); guard_set(av->guard_stored, victim, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(victim), bytes, 0, 0); return chunk(victim); } @@ -4140,6 +4201,6 @@ remainder->bk = remainder->fd = unsorted_chunks(av); /* advertise as last remainder */ - if (in_smallbin_range(nb)) - av->last_remainder = remainder; + if (in_smallbin_range(nb)) + av->last_remainder = remainder; set_head(victim, nb | PREV_INUSE | INUSE); @@ -4148,4 +4209,5 @@ check_malloced_chunk(victim, nb); guard_set(av->guard_stored, victim, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(victim), bytes, 0, 0); return chunk(victim); } @@ -4155,4 +4217,5 @@ check_malloced_chunk(victim, nb); guard_set(av->guard_stored, victim, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(victim), bytes, 0, 0); return chunk(victim); } @@ -4183,5 +4246,5 @@ if ((CHUNK_SIZE_T)(size) >= (CHUNK_SIZE_T)(nb + MINSIZE)) { - remainder = cireg_getfree(); + remainder = cireg_getfree(); remainder_size = size - nb; remainder->chunk = chunk_at_offset(chunk(victim), nb); @@ -4192,4 +4255,5 @@ check_malloced_chunk(victim, nb); guard_set(av->guard_stored, victim, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(victim), bytes, 0, 0); return chunk(victim); } @@ -4203,4 +4267,5 @@ guard_set(av->guard_stored, victim, bytes, nb); } + VALGRIND_MALLOCLIKE_BLOCK(retval, bytes, 0, 0); return retval; } @@ -4254,6 +4319,8 @@ } + VALGRIND_FREELIKE_BLOCK(mem, 0); + guard_check(av->guard_stored, p); - + size = chunksize(p); @@ -4471,4 +4538,5 @@ */ if (av && av->max_fast != 0) { + clear_fastchunks(av); @@ -4529,10 +4597,15 @@ clear_previnuse(nextchunk); + /* if mmap is used instead of sbrk, we may have a + * chunk with !nextchunk->fd && !nextchunk->bk + */ if (!inuse(nextchunk)) { - size += nextsize; - unlink(nextchunk, bck, fwd); - set_head(p, size | PREV_INUSE); - hashtable_skiprm(p,nextchunk); - freecilst_add(nextchunk); + if( nextchunk->fd && nextchunk->bk) { + size += nextsize; + unlink(nextchunk, bck, fwd); + set_head(p, size | PREV_INUSE); + hashtable_skiprm(p,nextchunk); + freecilst_add(nextchunk); + } } @@ -4551,5 +4624,5 @@ } - else { + else if (nextchunk == av->top) { size += nextsize; set_head(p, size | PREV_INUSE); @@ -4558,5 +4631,5 @@ av->top = p; } - } + } /* if (nextchunk) */ } while ( (p = nextp) != 0); @@ -4646,4 +4719,5 @@ } + VALGRIND_FREELIKE_BLOCK(oldmem, 0); guard_check(av->guard_stored, oldp); @@ -4675,4 +4749,5 @@ hashtable_insert(oldp, av->top); guard_set(av->guard_stored, oldp, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(oldp), bytes, 0, 0); return chunk(oldp); } @@ -4696,5 +4771,5 @@ newmem = mALLOc(nb - MALLOC_ALIGN_MASK); - if (newmem == 0) + if (newmem == 0) return 0; /* propagate failure */ @@ -4702,4 +4777,5 @@ newsize = chunksize(newp); + /* next = next_chunkinfo(oldp); *//* 'next' never used rw 19.05.2008 */ /* @@ -4720,4 +4796,6 @@ */ + VALGRIND_MALLOCLIKE_BLOCK(chunk(oldp), chunksize(oldp), 0, 0); + copysize = oldsize; s = (INTERNAL_SIZE_T*)(oldmem); @@ -4774,4 +4852,5 @@ set_all_inuse(remainder); guard_set(av->guard_stored, remainder, 0, remainder_size); + VALGRIND_MALLOCLIKE_BLOCK(chunk(remainder), remainder_size, 0, 0); fREe(chunk(remainder)); } @@ -4783,4 +4862,5 @@ check_inuse_chunk(newp); guard_set(av->guard_stored, newp, bytes, nb); + VALGRIND_MALLOCLIKE_BLOCK(chunk(newp), bytes, 0, 0); return chunk(newp); } @@ -4798,4 +4878,5 @@ CHUNK_SIZE_T sum; + /* Note the extra SIZE_SZ overhead */ //newsize = (nb + offset + SIZE_SZ + pagemask) & ~pagemask; @@ -4806,4 +4887,6 @@ { guard_set(av->guard_stored, oldp, bytes, nb); + VALGRIND_FREELIKE_BLOCK(oldmem, 0); + VALGRIND_MALLOCLIKE_BLOCK(oldmem, bytes, 0, 0); return oldmem; } @@ -4832,4 +4915,6 @@ guard_set(av->guard_stored, oldp, bytes, nb); + VALGRIND_FREELIKE_BLOCK(oldmem, 0); + VALGRIND_MALLOCLIKE_BLOCK(chunk(oldp), bytes, 0, 0); return chunk(oldp); } @@ -4847,4 +4932,5 @@ } } + VALGRIND_MALLOCLIKE_BLOCK(newmem, bytes, 0, 0); guard_set(av->guard_stored, mem2chunk(newmem), bytes, nb); return newmem; Index: trunk/src/make-tests.sh =================================================================== --- trunk/src/make-tests.sh (revision 171) +++ trunk/src/make-tests.sh (revision 172) @@ -57,7 +57,15 @@ int main(void) { +#if !defined(USE_SYSTEM_MALLOC) + typedef void assert_handler_tp(const char * error, const char *file, int line); + extern assert_handler_tp *dnmalloc_set_handler(assert_handler_tp *new); + extern void safe_fatal (const char * details, const char *f, int l); +#endif #if !defined(USE_SYSTEM_MALLOC) && defined(USE_MALLOC_LOCK) extern int dnmalloc_pthread_init(void); dnmalloc_pthread_init(); +#endif +#if !defined(USE_SYSTEM_MALLOC) + (void) dnmalloc_set_handler(safe_fatal); #endif int retval; Index: trunk/src/samhain.c =================================================================== --- trunk/src/samhain.c (revision 171) +++ trunk/src/samhain.c (revision 172) @@ -1220,4 +1220,10 @@ int my_argc = 0; char * my_argv[32]; +#endif + +#if !defined(USE_SYSTEM_MALLOC) + typedef void assert_handler_tp(const char * error, const char *file, int line); + extern assert_handler_tp *dnmalloc_set_handler(assert_handler_tp *new); + (void) dnmalloc_set_handler(safe_fatal); #endif Index: trunk/src/sh_unix.c =================================================================== --- trunk/src/sh_unix.c (revision 171) +++ trunk/src/sh_unix.c (revision 172) @@ -557,5 +557,5 @@ #endif { -#if defined(SL_DEBUG) +#if defined(SL_DEBUG) && (defined(USE_SYSTEM_MALLOC) || !defined(USE_MALLOC_LOCK)) int retval; #endif @@ -576,5 +576,5 @@ /* Check whether the heap is ok; otherwise _exit */ -#if !defined(SL_DEBUG) +#if !defined(SL_DEBUG) || (!defined(USE_SYSTEM_MALLOC) && defined(USE_MALLOC_LOCK)) ++immediate_exit_fast; if (skey != NULL && immediate_exit_fast < 2)