fix possible crash on user deletion

[srvx.git] / src / alloc-srvx.c

diff --git a/src/alloc-srvx.c b/src/alloc-srvx.c
index b8e1afab34cc18680d8f344b8a1c3df0b971d428..11de0fd637256199f0e22cd7e5d16246d65f16a2 100644 (file)
--- a/src/alloc-srvx.c
+++ b/src/alloc-srvx.c
@@ -15,11 +15,11 @@
  */
 
 #include "common.h"
+#include "log.h"
 
 #undef malloc
 #undef free
 
-/* cookies for anybody who recognizes these bytes without help :) */
 #define ALLOC_MAGIC 0x1acf
 #define FREE_MAGIC  0xfc1d
 const char redzone[] = { '\x03', '\x47', '\x76', '\xc7' };
@@ -61,6 +61,12 @@ srvx_malloc(const char *file, unsigned int line, size_t size)
 
     block = malloc(sizeof(*block) + size + sizeof(redzone));
     assert(block != NULL);
+    if (block->magic == ALLOC_MAGIC && block->file_id < file_ids_used) {
+        /* Only report the error, due to possible false positives. */
+        log_module(MAIN_LOG, LOG_WARNING, "Detected possible reallocation: %p (called by %s:%u/%lu; allocated by %u:%u/%u).",
+                   block, file, line, (unsigned long)size,
+                   block->file_id, block->line, block->size);
+    }
     memset(block, 0, sizeof(*block) + size);
     memcpy((char*)(block + 1) + size, redzone, sizeof(redzone));
     block->file_id = get_file_id(file);
@@ -75,19 +81,22 @@ srvx_malloc(const char *file, unsigned int line, size_t size)
 void *
 srvx_realloc(const char *file, unsigned int line, void *ptr, size_t size)
 {
-    struct alloc_header *block = NULL, *newblock;
-
-    if (ptr) {
-        block = (struct alloc_header *)ptr - 1;
-        assert(block->magic == ALLOC_MAGIC);
-        assert(0 == memcmp((char*)(block + 1) + block->size, redzone, sizeof(redzone)));
-        if (block->size >= size)
-            return block + 1;
-    }
+    struct alloc_header *block, *newblock;
+
+    if (!ptr)
+        return srvx_malloc(file, line, size);
+
+    verify(ptr);
+    block = (struct alloc_header *)ptr - 1;
+
+    if (block->size >= size)
+        return block + 1;
 
     newblock = malloc(sizeof(*newblock) + size + sizeof(redzone));
     assert(newblock != NULL);
-    memset(newblock, 0, sizeof(*newblock) + size + sizeof(redzone));
+    memset(newblock, 0, sizeof(*newblock));
+    memcpy(newblock + 1, block + 1, block->size);
+    memset((char*)(newblock + 1) + block->size, 0, size - block->size);
     memcpy((char*)(newblock + 1) + size, redzone, sizeof(redzone));
     newblock->file_id = get_file_id(file);
     newblock->line = line;
@@ -96,15 +105,7 @@ srvx_realloc(const char *file, unsigned int line, void *ptr, size_t size)
     alloc_count++;
     alloc_size += size;
 
-    if (ptr) {
-        memcpy(newblock + 1, block + 1, block->size);
-        size = block->size + sizeof(*block);
-        memset(block, 0, size);
-        block->magic = FREE_MAGIC;
-        free(block);
-        alloc_count--;
-        alloc_size -= size - sizeof(*block);
-    }
+    srvx_free(file, line, block + 1);
 
     return newblock + 1;
 }
@@ -122,21 +123,30 @@ srvx_strdup(const char *file, unsigned int line, const char *src)
 }
 
 void
-srvx_free(const char *file, unsigned int line, void *ptr)
+srvx_free(UNUSED_ARG(const char *file), UNUSED_ARG(unsigned int line), void *ptr)
 {
     struct alloc_header *block;
     size_t size;
 
     if (!ptr)
         return;
+    verify(ptr);
     block = (struct alloc_header *)ptr - 1;
-    assert(block->magic == ALLOC_MAGIC);
-    assert(0 == memcmp((char*)(block + 1) + block->size, redzone, sizeof(redzone)));
-    size = block->size + sizeof(*block);
-    memset(block, 0, size);
+    size = block->size;
+    memset(block + 1, 0xde, size);
     block->magic = FREE_MAGIC;
     free(block);
     alloc_count--;
-    alloc_size -= size - sizeof(*block);
-    (void)file; (void)line;
+    alloc_size -= size;
+}
+
+void
+verify(const void *ptr)
+{
+    const struct alloc_header *header;
+    if (!ptr)
+        return;
+    header = (const struct alloc_header*)ptr - 1;
+    assert(header->magic == ALLOC_MAGIC);
+    assert(!memcmp((char*)(header + 1) + header->size, redzone, sizeof(redzone)));
 }