Skip to content

Commit 118eecb

Browse files
committed
Check for heap corruption
The allocator id and sizeclass are stored in deallocated objects to provide quick lookup. This adds checks that these are actually correct.
1 parent c58a690 commit 118eecb

File tree

1 file changed

+15
-4
lines changed

1 file changed

+15
-4
lines changed

src/mem/alloc.h

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -916,18 +916,29 @@ namespace snmalloc
916916
if (likely(sizeclass < NUM_SMALL_CLASSES))
917917
{
918918
SNMALLOC_ASSERT(super->get_kind() == Super);
919+
check_client(
920+
super->get_kind() == Super,
921+
"Heap Corruption: Sizeclass of remote dealloc corrupt.");
919922
auto slab =
920923
Metaslab::get_slab(Aal::capptr_rebound(super.as_void(), p_offseted));
924+
check_client(
925+
super->get_meta(slab)->sizeclass() == sizeclass,
926+
"Heap Corruption: Sizeclass of remote dealloc corrupt.");
921927
small_dealloc_offseted(
922928
super, slab, FreeObject::make(p_offseted), sizeclass);
923929
}
924930
else
925931
{
926-
SNMALLOC_ASSERT(super->get_kind() == Medium);
932+
auto medium = super.template as_reinterpret<Mediumslab>();
933+
SNMALLOC_ASSERT(medium->get_kind() == Medium);
934+
check_client(
935+
medium->get_kind() == Medium,
936+
"Heap Corruption: Sizeclass of remote dealloc corrupt.");
937+
check_client(
938+
medium->get_sizeclass() == sizeclass,
939+
"Heap Corruption: Sizeclass of remote dealloc corrupt.");
927940
medium_dealloc_local(
928-
super.template as_reinterpret<Mediumslab>(),
929-
Remote::clear(p_offseted, sizeclass),
930-
sizeclass);
941+
medium, Remote::clear(p_offseted, sizeclass), sizeclass);
931942
}
932943
}
933944

0 commit comments

Comments
 (0)