555 lines · cpp
1//===-- asan_malloc_win.cpp -----------------------------------------------===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// This file is a part of AddressSanitizer, an address sanity checker.10//11// Windows-specific malloc interception.12//===----------------------------------------------------------------------===//13 14#include "sanitizer_common/sanitizer_allocator_interface.h"15#include "sanitizer_common/sanitizer_platform.h"16#if SANITIZER_WINDOWS17#include "asan_allocator.h"18#include "asan_interceptors.h"19#include "asan_internal.h"20#include "asan_stack.h"21#include "interception/interception.h"22#include <stddef.h>23 24// Intentionally not including windows.h here, to avoid the risk of25// pulling in conflicting declarations of these functions. (With mingw-w64,26// there's a risk of windows.h pulling in stdint.h.)27typedef int BOOL;28typedef void *HANDLE;29typedef const void *LPCVOID;30typedef void *LPVOID;31 32typedef unsigned long DWORD;33constexpr unsigned long HEAP_ZERO_MEMORY = 0x00000008;34constexpr unsigned long HEAP_REALLOC_IN_PLACE_ONLY = 0x00000010;35constexpr unsigned long HEAP_ALLOCATE_SUPPORTED_FLAGS = (HEAP_ZERO_MEMORY);36constexpr unsigned long HEAP_ALLOCATE_UNSUPPORTED_FLAGS =37 (~HEAP_ALLOCATE_SUPPORTED_FLAGS);38constexpr unsigned long HEAP_FREE_UNSUPPORTED_FLAGS =39 (~HEAP_ALLOCATE_SUPPORTED_FLAGS);40constexpr unsigned long HEAP_REALLOC_UNSUPPORTED_FLAGS =41 (~HEAP_ALLOCATE_SUPPORTED_FLAGS);42 43 44extern "C" {45LPVOID WINAPI HeapAlloc(HANDLE hHeap, DWORD dwFlags, size_t dwBytes);46LPVOID WINAPI HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem,47 size_t dwBytes);48BOOL WINAPI HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);49size_t WINAPI HeapSize(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem);50 51BOOL WINAPI HeapValidate(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem);52}53 54using namespace __asan;55 56// MT: Simply defining functions with the same signature in *.obj57// files overrides the standard functions in the CRT.58// MD: Memory allocation functions are defined in the CRT .dll,59// so we have to intercept them before they are called for the first time.60 61extern "C" {62__declspec(noinline) size_t _msize(void *ptr) {63 GET_CURRENT_PC_BP_SP;64 (void)sp;65 return asan_malloc_usable_size(ptr, pc, bp);66}67 68__declspec(noinline) size_t _msize_base(void *ptr) { return _msize(ptr); }69 70__declspec(noinline) void free(void *ptr) {71 GET_STACK_TRACE_FREE;72 return asan_free(ptr, &stack);73}74 75__declspec(noinline) void _free_dbg(void *ptr, int) { free(ptr); }76 77__declspec(noinline) void _free_base(void *ptr) { free(ptr); }78 79__declspec(noinline) void *malloc(size_t size) {80 GET_STACK_TRACE_MALLOC;81 return asan_malloc(size, &stack);82}83 84__declspec(noinline) void *_malloc_base(size_t size) { return malloc(size); }85 86__declspec(noinline) void *_malloc_dbg(size_t size, int, const char *, int) {87 return malloc(size);88}89 90__declspec(noinline) void *calloc(size_t nmemb, size_t size) {91 GET_STACK_TRACE_MALLOC;92 return asan_calloc(nmemb, size, &stack);93}94 95__declspec(noinline) void *_calloc_base(size_t nmemb, size_t size) {96 return calloc(nmemb, size);97}98 99__declspec(noinline) void *_calloc_dbg(size_t nmemb, size_t size, int,100 const char *, int) {101 return calloc(nmemb, size);102}103 104__declspec(noinline) void *_calloc_impl(size_t nmemb, size_t size,105 int *errno_tmp) {106 return calloc(nmemb, size);107}108 109__declspec(noinline) void *realloc(void *ptr, size_t size) {110 GET_STACK_TRACE_MALLOC;111 return asan_realloc(ptr, size, &stack);112}113 114__declspec(noinline) void *_realloc_dbg(void *ptr, size_t size, int) {115 UNREACHABLE("_realloc_dbg should not exist!");116 return 0;117}118 119__declspec(noinline) void *_realloc_base(void *ptr, size_t size) {120 return realloc(ptr, size);121}122 123__declspec(noinline) void *_recalloc(void *p, size_t n, size_t elem_size) {124 if (!p)125 return calloc(n, elem_size);126 const size_t size = n * elem_size;127 if (elem_size != 0 && size / elem_size != n)128 return 0;129 130 size_t old_size = _msize(p);131 void *new_alloc = malloc(size);132 if (new_alloc) {133 REAL(memcpy)(new_alloc, p, Min<size_t>(size, old_size));134 if (old_size < size)135 REAL(memset)(((u8 *)new_alloc) + old_size, 0, size - old_size);136 free(p);137 }138 return new_alloc;139}140 141__declspec(noinline) void *_recalloc_base(void *p, size_t n, size_t elem_size) {142 return _recalloc(p, n, elem_size);143}144 145__declspec(noinline) void *_expand(void *memblock, size_t size) {146 // _expand is used in realloc-like functions to resize the buffer if possible.147 // We don't want memory to stand still while resizing buffers, so return 0.148 return 0;149}150 151__declspec(noinline) void *_expand_dbg(void *memblock, size_t size) {152 return _expand(memblock, size);153}154 155__declspec(dllexport) size_t __cdecl __asan_msize(void *ptr) {156 return _msize(ptr);157}158__declspec(dllexport) void __cdecl __asan_free(void *const ptr) { free(ptr); }159__declspec(dllexport) void *__cdecl __asan_malloc(const size_t size) {160 return malloc(size);161}162__declspec(dllexport) void *__cdecl __asan_calloc(const size_t nmemb,163 const size_t size) {164 return calloc(nmemb, size);165}166__declspec(dllexport) void *__cdecl __asan_realloc(void *const ptr,167 const size_t size) {168 return realloc(ptr, size);169}170__declspec(dllexport) void *__cdecl __asan_recalloc(void *const ptr,171 const size_t nmemb,172 const size_t size) {173 return _recalloc(ptr, nmemb, size);174}175 176// TODO(timurrrr): Might want to add support for _aligned_* allocation177// functions to detect a bit more bugs. Those functions seem to wrap malloc().178 179int _CrtDbgReport(int, const char*, int,180 const char*, const char*, ...) {181 ShowStatsAndAbort();182}183 184int _CrtDbgReportW(int reportType, const wchar_t*, int,185 const wchar_t*, const wchar_t*, ...) {186 ShowStatsAndAbort();187}188 189int _CrtSetReportMode(int, int) {190 return 0;191}192} // extern "C"193 194#define OWNED_BY_RTL(heap, memory) \195 (!__sanitizer_get_ownership(memory) && HeapValidate(heap, 0, memory))196 197INTERCEPTOR_WINAPI(size_t, HeapSize, HANDLE hHeap, DWORD dwFlags,198 LPCVOID lpMem) {199 // If the RTL allocators are hooked we need to check whether the ASAN200 // allocator owns the pointer we're about to use. Allocations occur before201 // interception takes place, so if it is not owned by the RTL heap we can202 // pass it to the ASAN heap for inspection.203 if (flags()->windows_hook_rtl_allocators) {204 if (!AsanInited() || OWNED_BY_RTL(hHeap, lpMem))205 return REAL(HeapSize)(hHeap, dwFlags, lpMem);206 } else {207 CHECK(dwFlags == 0 && "unsupported heap flags");208 }209 GET_CURRENT_PC_BP_SP;210 (void)sp;211 return asan_malloc_usable_size(lpMem, pc, bp);212}213 214INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags,215 size_t dwBytes) {216 // If the ASAN runtime is not initialized, or we encounter an unsupported217 // flag, fall back to the original allocator.218 if (flags()->windows_hook_rtl_allocators) {219 if (UNLIKELY(!AsanInited() ||220 (dwFlags & HEAP_ALLOCATE_UNSUPPORTED_FLAGS) != 0)) {221 return REAL(HeapAlloc)(hHeap, dwFlags, dwBytes);222 }223 } else {224 // In the case that we don't hook the rtl allocators,225 // this becomes an assert since there is no failover to the original226 // allocator.227 CHECK((HEAP_ALLOCATE_UNSUPPORTED_FLAGS & dwFlags) != 0 &&228 "unsupported flags");229 }230 GET_STACK_TRACE_MALLOC;231 void *p = asan_malloc(dwBytes, &stack);232 // Reading MSDN suggests that the *entire* usable allocation is zeroed out.233 // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.234 // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083235 if (p && (dwFlags & HEAP_ZERO_MEMORY)) {236 GET_CURRENT_PC_BP_SP;237 (void)sp;238 auto usable_size = asan_malloc_usable_size(p, pc, bp);239 internal_memset(p, 0, usable_size);240 }241 return p;242}243 244INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) {245 // Heap allocations happen before this function is hooked, so we must fall246 // back to the original function if the pointer is not from the ASAN heap,247 // or unsupported flags are provided.248 if (flags()->windows_hook_rtl_allocators) {249 if (OWNED_BY_RTL(hHeap, lpMem))250 return REAL(HeapFree)(hHeap, dwFlags, lpMem);251 } else {252 CHECK((HEAP_FREE_UNSUPPORTED_FLAGS & dwFlags) != 0 && "unsupported flags");253 }254 GET_STACK_TRACE_FREE;255 asan_free(lpMem, &stack);256 return true;257}258 259namespace __asan {260using AllocFunction = LPVOID(WINAPI *)(HANDLE, DWORD, size_t);261using ReAllocFunction = LPVOID(WINAPI *)(HANDLE, DWORD, LPVOID, size_t);262using SizeFunction = size_t(WINAPI *)(HANDLE, DWORD, LPVOID);263using FreeFunction = BOOL(WINAPI *)(HANDLE, DWORD, LPVOID);264 265void *SharedReAlloc(ReAllocFunction reallocFunc, SizeFunction heapSizeFunc,266 FreeFunction freeFunc, AllocFunction allocFunc,267 HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, size_t dwBytes) {268 CHECK(reallocFunc && heapSizeFunc && freeFunc && allocFunc);269 GET_STACK_TRACE_MALLOC;270 GET_CURRENT_PC_BP_SP;271 (void)sp;272 if (flags()->windows_hook_rtl_allocators) {273 enum AllocationOwnership { NEITHER = 0, ASAN = 1, RTL = 2 };274 AllocationOwnership ownershipState;275 bool owned_rtlalloc = false;276 bool owned_asan = __sanitizer_get_ownership(lpMem);277 278 if (!owned_asan)279 owned_rtlalloc = HeapValidate(hHeap, 0, lpMem);280 281 if (owned_asan && !owned_rtlalloc)282 ownershipState = ASAN;283 else if (!owned_asan && owned_rtlalloc)284 ownershipState = RTL;285 else if (!owned_asan && !owned_rtlalloc)286 ownershipState = NEITHER;287 288 // If this heap block which was allocated before the ASAN289 // runtime came up, use the real HeapFree function.290 if (UNLIKELY(!AsanInited())) {291 return reallocFunc(hHeap, dwFlags, lpMem, dwBytes);292 }293 bool only_asan_supported_flags =294 (HEAP_REALLOC_UNSUPPORTED_FLAGS & dwFlags) == 0;295 296 if (ownershipState == RTL ||297 (ownershipState == NEITHER && !only_asan_supported_flags)) {298 if (only_asan_supported_flags) {299 // if this is a conversion to ASAN upported flags, transfer this300 // allocation to the ASAN allocator301 void *replacement_alloc;302 if (dwFlags & HEAP_ZERO_MEMORY)303 replacement_alloc = asan_calloc(1, dwBytes, &stack);304 else305 replacement_alloc = asan_malloc(dwBytes, &stack);306 if (replacement_alloc) {307 size_t old_size = heapSizeFunc(hHeap, dwFlags, lpMem);308 if (old_size == ((size_t)0) - 1) {309 asan_free(replacement_alloc, &stack);310 return nullptr;311 }312 REAL(memcpy)(replacement_alloc, lpMem, old_size);313 freeFunc(hHeap, dwFlags, lpMem);314 }315 return replacement_alloc;316 } else {317 // owned by rtl or neither with unsupported ASAN flags,318 // just pass back to original allocator319 CHECK(ownershipState == RTL || ownershipState == NEITHER);320 CHECK(!only_asan_supported_flags);321 return reallocFunc(hHeap, dwFlags, lpMem, dwBytes);322 }323 }324 325 if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY) {326 size_t old_usable_size = asan_malloc_usable_size(lpMem, pc, bp);327 if (dwBytes == old_usable_size) {328 // Nothing to change, return the current pointer.329 return lpMem;330 } else if (dwBytes >= old_usable_size) {331 // Growing with HEAP_REALLOC_IN_PLACE_ONLY is not supported.332 return nullptr;333 } else {334 // Shrinking with HEAP_REALLOC_IN_PLACE_ONLY is not yet supported.335 // For now return the current pointer and336 // leave the allocation size as it is.337 return lpMem;338 }339 }340 341 if (ownershipState == ASAN && !only_asan_supported_flags) {342 // Conversion to unsupported flags allocation,343 // transfer this allocation back to the original allocator.344 void *replacement_alloc = allocFunc(hHeap, dwFlags, dwBytes);345 size_t old_usable_size = 0;346 if (replacement_alloc) {347 old_usable_size = asan_malloc_usable_size(lpMem, pc, bp);348 REAL(memcpy)(replacement_alloc, lpMem,349 Min<size_t>(dwBytes, old_usable_size));350 asan_free(lpMem, &stack);351 }352 return replacement_alloc;353 }354 355 CHECK((ownershipState == ASAN || ownershipState == NEITHER) &&356 only_asan_supported_flags);357 // At this point we should either be ASAN owned with ASAN supported flags358 // or we owned by neither and have supported flags.359 // Pass through even when it's neither since this could be a null realloc or360 // UAF that ASAN needs to catch.361 } else {362 CHECK((HEAP_REALLOC_UNSUPPORTED_FLAGS & dwFlags) != 0 &&363 "unsupported flags");364 }365 // asan_realloc will never reallocate in place, so for now this flag is366 // unsupported until we figure out a way to fake this.367 if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY)368 return nullptr;369 370 // HeapReAlloc and HeapAlloc both happily accept 0 sized allocations.371 // passing a 0 size into asan_realloc will free the allocation.372 // To avoid this and keep behavior consistent, fudge the size if 0.373 // (asan_malloc already does this)374 if (dwBytes == 0)375 dwBytes = 1;376 377 size_t old_size;378 if (dwFlags & HEAP_ZERO_MEMORY)379 old_size = asan_malloc_usable_size(lpMem, pc, bp);380 381 void *ptr = asan_realloc(lpMem, dwBytes, &stack);382 if (ptr == nullptr)383 return nullptr;384 385 if (dwFlags & HEAP_ZERO_MEMORY) {386 size_t new_size = asan_malloc_usable_size(ptr, pc, bp);387 if (old_size < new_size)388 REAL(memset)(((u8 *)ptr) + old_size, 0, new_size - old_size);389 }390 391 return ptr;392}393} // namespace __asan394 395INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags,396 LPVOID lpMem, size_t dwBytes) {397 return SharedReAlloc(REAL(HeapReAlloc), (SizeFunction)REAL(HeapSize),398 REAL(HeapFree), REAL(HeapAlloc), hHeap, dwFlags, lpMem,399 dwBytes);400}401 402// The following functions are undocumented and subject to change.403// However, hooking them is necessary to hook Windows heap404// allocations with detours and their definitions are unlikely to change.405// Comments in /minkernel/ntos/rtl/heappublic.c indicate that these functions406// are part of the heap's public interface.407typedef unsigned long LOGICAL;408 409// This function is documented as part of the Driver Development Kit but *not*410// the Windows Development Kit.411LOGICAL RtlFreeHeap(void* HeapHandle, DWORD Flags,412 void* BaseAddress);413 414// This function is documented as part of the Driver Development Kit but *not*415// the Windows Development Kit.416void* RtlAllocateHeap(void* HeapHandle, DWORD Flags, size_t Size);417 418// This function is completely undocumented.419void*420RtlReAllocateHeap(void* HeapHandle, DWORD Flags, void* BaseAddress,421 size_t Size);422 423// This function is completely undocumented.424size_t RtlSizeHeap(void* HeapHandle, DWORD Flags, void* BaseAddress);425 426INTERCEPTOR_WINAPI(size_t, RtlSizeHeap, HANDLE HeapHandle, DWORD Flags,427 void* BaseAddress) {428 if (!flags()->windows_hook_rtl_allocators ||429 UNLIKELY(!AsanInited() || OWNED_BY_RTL(HeapHandle, BaseAddress))) {430 return REAL(RtlSizeHeap)(HeapHandle, Flags, BaseAddress);431 }432 GET_CURRENT_PC_BP_SP;433 (void)sp;434 return asan_malloc_usable_size(BaseAddress, pc, bp);435}436 437INTERCEPTOR_WINAPI(BOOL, RtlFreeHeap, HANDLE HeapHandle, DWORD Flags,438 void* BaseAddress) {439 // Heap allocations happen before this function is hooked, so we must fall440 // back to the original function if the pointer is not from the ASAN heap, or441 // unsupported flags are provided.442 if (!flags()->windows_hook_rtl_allocators ||443 UNLIKELY((HEAP_FREE_UNSUPPORTED_FLAGS & Flags) != 0 ||444 OWNED_BY_RTL(HeapHandle, BaseAddress))) {445 return REAL(RtlFreeHeap)(HeapHandle, Flags, BaseAddress);446 }447 GET_STACK_TRACE_FREE;448 asan_free(BaseAddress, &stack);449 return true;450}451 452INTERCEPTOR_WINAPI(void*, RtlAllocateHeap, HANDLE HeapHandle, DWORD Flags,453 size_t Size) {454 // If the ASAN runtime is not initialized, or we encounter an unsupported455 // flag, fall back to the original allocator.456 if (!flags()->windows_hook_rtl_allocators ||457 UNLIKELY(!AsanInited() ||458 (Flags & HEAP_ALLOCATE_UNSUPPORTED_FLAGS) != 0)) {459 return REAL(RtlAllocateHeap)(HeapHandle, Flags, Size);460 }461 GET_STACK_TRACE_MALLOC;462 void *p;463 // Reading MSDN suggests that the *entire* usable allocation is zeroed out.464 // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.465 // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083466 if (Flags & HEAP_ZERO_MEMORY) {467 p = asan_calloc(Size, 1, &stack);468 } else {469 p = asan_malloc(Size, &stack);470 }471 return p;472}473 474INTERCEPTOR_WINAPI(void*, RtlReAllocateHeap, HANDLE HeapHandle, DWORD Flags,475 void* BaseAddress, size_t Size) {476 // If it's actually a heap block which was allocated before the ASAN runtime477 // came up, use the real RtlFreeHeap function.478 if (!flags()->windows_hook_rtl_allocators)479 return REAL(RtlReAllocateHeap)(HeapHandle, Flags, BaseAddress, Size);480 481 return SharedReAlloc(REAL(RtlReAllocateHeap), REAL(RtlSizeHeap),482 REAL(RtlFreeHeap), REAL(RtlAllocateHeap), HeapHandle,483 Flags, BaseAddress, Size);484}485 486namespace __asan {487 488static void TryToOverrideFunction(const char *fname, uptr new_func) {489 // Failure here is not fatal. The CRT may not be present, and different CRT490 // versions use different symbols.491 if (!__interception::OverrideFunction(fname, new_func))492 VPrintf(2, "Failed to override function %s\n", fname);493}494 495void ReplaceSystemMalloc() {496 TryToOverrideFunction("free", (uptr)free);497 TryToOverrideFunction("_free_base", (uptr)free);498 TryToOverrideFunction("malloc", (uptr)malloc);499 TryToOverrideFunction("_malloc_base", (uptr)malloc);500 TryToOverrideFunction("_malloc_crt", (uptr)malloc);501 TryToOverrideFunction("calloc", (uptr)calloc);502 TryToOverrideFunction("_calloc_base", (uptr)calloc);503 TryToOverrideFunction("_calloc_crt", (uptr)calloc);504 TryToOverrideFunction("realloc", (uptr)realloc);505 TryToOverrideFunction("_realloc_base", (uptr)realloc);506 TryToOverrideFunction("_realloc_crt", (uptr)realloc);507 TryToOverrideFunction("_recalloc", (uptr)_recalloc);508 TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);509 TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);510 TryToOverrideFunction("_msize", (uptr)_msize);511 TryToOverrideFunction("_msize_base", (uptr)_msize);512 TryToOverrideFunction("_expand", (uptr)_expand);513 TryToOverrideFunction("_expand_base", (uptr)_expand);514 515 if (flags()->windows_hook_rtl_allocators) {516 ASAN_INTERCEPT_FUNC(HeapSize);517 ASAN_INTERCEPT_FUNC(HeapFree);518 ASAN_INTERCEPT_FUNC(HeapReAlloc);519 ASAN_INTERCEPT_FUNC(HeapAlloc);520 521 // Undocumented functions must be intercepted by name, not by symbol.522 __interception::OverrideFunction("RtlSizeHeap", (uptr)WRAP(RtlSizeHeap),523 (uptr *)&REAL(RtlSizeHeap));524 __interception::OverrideFunction("RtlFreeHeap", (uptr)WRAP(RtlFreeHeap),525 (uptr *)&REAL(RtlFreeHeap));526 __interception::OverrideFunction("RtlReAllocateHeap",527 (uptr)WRAP(RtlReAllocateHeap),528 (uptr *)&REAL(RtlReAllocateHeap));529 __interception::OverrideFunction("RtlAllocateHeap",530 (uptr)WRAP(RtlAllocateHeap),531 (uptr *)&REAL(RtlAllocateHeap));532 } else {533#define INTERCEPT_UCRT_FUNCTION(func) \534 if (!INTERCEPT_FUNCTION_DLLIMPORT( \535 "ucrtbase.dll", "api-ms-win-core-heap-l1-1-0.dll", func)) { \536 VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func); \537 }538 INTERCEPT_UCRT_FUNCTION(HeapAlloc);539 INTERCEPT_UCRT_FUNCTION(HeapFree);540 INTERCEPT_UCRT_FUNCTION(HeapReAlloc);541 INTERCEPT_UCRT_FUNCTION(HeapSize);542#undef INTERCEPT_UCRT_FUNCTION543 }544 // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which545 // enable cross-module inlining. This means our _malloc_base hook won't catch546 // all CRT allocations. This code here patches the import table of547 // ucrtbase.dll so that all attempts to use the lower-level win32 heap548 // allocation API will be directed to ASan's heap. We don't currently549 // intercept all calls to HeapAlloc. If we did, we would have to check on550 // HeapFree whether the pointer came from ASan of from the system.551}552} // namespace __asan553 554#endif // _WIN32555