|
@@ -66,9 +66,9 @@ void MallocTracer::target_did_free(Badge<SoftCPU>, FlatPtr address)
|
|
for (auto& mallocation : m_mallocations) {
|
|
for (auto& mallocation : m_mallocations) {
|
|
if (mallocation.address == address) {
|
|
if (mallocation.address == address) {
|
|
if (mallocation.freed) {
|
|
if (mallocation.freed) {
|
|
- dbgprintf("\n");
|
|
|
|
- dbgprintf("==%d== \033[31;1mDouble free()\033[0m, %p\n", getpid(), address);
|
|
|
|
- dbgprintf("==%d== Address %p has already been passed to free()\n", getpid(), address);
|
|
|
|
|
|
+ report("\n");
|
|
|
|
+ report("==%d== \033[31;1mDouble free()\033[0m, %p\n", getpid(), address);
|
|
|
|
+ report("==%d== Address %p has already been passed to free()\n", getpid(), address);
|
|
Emulator::the().dump_backtrace();
|
|
Emulator::the().dump_backtrace();
|
|
} else {
|
|
} else {
|
|
mallocation.freed = true;
|
|
mallocation.freed = true;
|
|
@@ -77,9 +77,9 @@ void MallocTracer::target_did_free(Badge<SoftCPU>, FlatPtr address)
|
|
return;
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
- dbgprintf("\n");
|
|
|
|
- dbgprintf("==%d== \033[31;1mInvalid free()\033[0m, %p\n", getpid(), address);
|
|
|
|
- dbgprintf("==%d== Address %p has never been returned by malloc()\n", getpid(), address);
|
|
|
|
|
|
+ report("\n");
|
|
|
|
+ report("==%d== \033[31;1mInvalid free()\033[0m, %p\n", getpid(), address);
|
|
|
|
+ report("==%d== Address %p has never been returned by malloc()\n", getpid(), address);
|
|
Emulator::the().dump_backtrace();
|
|
Emulator::the().dump_backtrace();
|
|
}
|
|
}
|
|
|
|
|
|
@@ -107,12 +107,12 @@ void MallocTracer::audit_read(FlatPtr address, size_t size)
|
|
size_t offset_into_mallocation = address - mallocation->address;
|
|
size_t offset_into_mallocation = address - mallocation->address;
|
|
|
|
|
|
if (mallocation->freed) {
|
|
if (mallocation->freed) {
|
|
- dbgprintf("\n");
|
|
|
|
- dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte read at address %p\n", getpid(), size, address);
|
|
|
|
|
|
+ report("\n");
|
|
|
|
+ report("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte read at address %p\n", getpid(), size, address);
|
|
Emulator::the().dump_backtrace();
|
|
Emulator::the().dump_backtrace();
|
|
- dbgprintf("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", getpid(), offset_into_mallocation, mallocation->size);
|
|
|
|
|
|
+ report("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", getpid(), offset_into_mallocation, mallocation->size);
|
|
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
|
|
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
|
|
- dbgprintf("==%d== Later freed at:\n", getpid(), offset_into_mallocation, mallocation->size);
|
|
|
|
|
|
+ report("==%d== Later freed at:\n", getpid(), offset_into_mallocation, mallocation->size);
|
|
Emulator::the().dump_backtrace(mallocation->free_backtrace);
|
|
Emulator::the().dump_backtrace(mallocation->free_backtrace);
|
|
return;
|
|
return;
|
|
}
|
|
}
|
|
@@ -133,12 +133,12 @@ void MallocTracer::audit_write(FlatPtr address, size_t size)
|
|
size_t offset_into_mallocation = address - mallocation->address;
|
|
size_t offset_into_mallocation = address - mallocation->address;
|
|
|
|
|
|
if (mallocation->freed) {
|
|
if (mallocation->freed) {
|
|
- dbgprintf("\n");
|
|
|
|
- dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte write at address %p\n", getpid(), size, address);
|
|
|
|
|
|
+ report("\n");
|
|
|
|
+ report("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte write at address %p\n", getpid(), size, address);
|
|
Emulator::the().dump_backtrace();
|
|
Emulator::the().dump_backtrace();
|
|
- dbgprintf("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", getpid(), offset_into_mallocation, mallocation->size);
|
|
|
|
|
|
+ report("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", getpid(), offset_into_mallocation, mallocation->size);
|
|
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
|
|
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
|
|
- dbgprintf("==%d== Later freed at:\n", getpid(), offset_into_mallocation, mallocation->size);
|
|
|
|
|
|
+ report("==%d== Later freed at:\n", getpid(), offset_into_mallocation, mallocation->size);
|
|
Emulator::the().dump_backtrace(mallocation->free_backtrace);
|
|
Emulator::the().dump_backtrace(mallocation->free_backtrace);
|
|
return;
|
|
return;
|
|
}
|
|
}
|
|
@@ -159,7 +159,7 @@ bool MallocTracer::is_reachable(const Mallocation& mallocation) const
|
|
auto value = Emulator::the().mmu().read32({ 0x20, other_mallocation.address + i * sizeof(u32) });
|
|
auto value = Emulator::the().mmu().read32({ 0x20, other_mallocation.address + i * sizeof(u32) });
|
|
if (value.value() == mallocation.address && !value.is_uninitialized()) {
|
|
if (value.value() == mallocation.address && !value.is_uninitialized()) {
|
|
#ifdef REACHABLE_DEBUG
|
|
#ifdef REACHABLE_DEBUG
|
|
- dbgprintf("mallocation %p is reachable from other mallocation %p\n", mallocation.address, other_mallocation.address);
|
|
|
|
|
|
+ report("mallocation %p is reachable from other mallocation %p\n", mallocation.address, other_mallocation.address);
|
|
#endif
|
|
#endif
|
|
return true;
|
|
return true;
|
|
}
|
|
}
|
|
@@ -184,7 +184,7 @@ bool MallocTracer::is_reachable(const Mallocation& mallocation) const
|
|
auto value = region.read32(i * sizeof(u32));
|
|
auto value = region.read32(i * sizeof(u32));
|
|
if (value.value() == mallocation.address && !value.is_uninitialized()) {
|
|
if (value.value() == mallocation.address && !value.is_uninitialized()) {
|
|
#ifdef REACHABLE_DEBUG
|
|
#ifdef REACHABLE_DEBUG
|
|
- dbgprintf("mallocation %p is reachable from region %p-%p\n", mallocation.address, region.base(), region.end() - 1);
|
|
|
|
|
|
+ report("mallocation %p is reachable from region %p-%p\n", mallocation.address, region.base(), region.end() - 1);
|
|
#endif
|
|
#endif
|
|
reachable = true;
|
|
reachable = true;
|
|
return IterationDecision::Break;
|
|
return IterationDecision::Break;
|
|
@@ -208,16 +208,16 @@ void MallocTracer::dump_leak_report()
|
|
continue;
|
|
continue;
|
|
++leaks_found;
|
|
++leaks_found;
|
|
bytes_leaked += mallocation.size;
|
|
bytes_leaked += mallocation.size;
|
|
- dbgprintf("\n");
|
|
|
|
- dbgprintf("==%d== \033[31;1mLeak\033[0m, %zu-byte allocation at address %#08x\n", getpid(), mallocation.size, mallocation.address);
|
|
|
|
|
|
+ report("\n");
|
|
|
|
+ report("==%d== \033[31;1mLeak\033[0m, %zu-byte allocation at address %#08x\n", getpid(), mallocation.size, mallocation.address);
|
|
Emulator::the().dump_backtrace(mallocation.malloc_backtrace);
|
|
Emulator::the().dump_backtrace(mallocation.malloc_backtrace);
|
|
}
|
|
}
|
|
|
|
|
|
- dbgprintf("\n");
|
|
|
|
|
|
+ report("\n");
|
|
if (!leaks_found)
|
|
if (!leaks_found)
|
|
- dbgprintf("==%d== \033[32;1mNo leaks found!\033[0m\n", getpid());
|
|
|
|
|
|
+ report("==%d== \033[32;1mNo leaks found!\033[0m\n", getpid());
|
|
else
|
|
else
|
|
- dbgprintf("==%d== \033[31;1m%zu leak(s) found: %zu byte(s) leaked\033[0m\n", getpid(), leaks_found, bytes_leaked);
|
|
|
|
|
|
+ report("==%d== \033[31;1m%zu leak(s) found: %zu byte(s) leaked\033[0m\n", getpid(), leaks_found, bytes_leaked);
|
|
}
|
|
}
|
|
|
|
|
|
}
|
|
}
|