fergalmoran/ladybird
1
0
Fork 0
mirror of https://github.com/fergalmoran/ladybird.git synced 2026-05-20 01:59:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

UserspaceEmulator: Include malloc/free backtraces in UAF logs :^)

Browse Source 
When catching a use-after-free, we now also print out the backtraces
for where the memory was allocated, and for where it was freed.

This will be extremely helpful for debugging.
This commit is contained in:
Andreas Kling
2020-07-16 17:23:39 +02:00
parent dd68370efc
commit 1dcc21d32e
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
DevTools/UserspaceEmulator/MallocTracer.cpp
View File

@@ -101,8 +101,11 @@ void MallocTracer::audit_read(FlatPtr address, size_t size)
if (mallocation->freed) {
dbgprintf("\n");
dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte read at address %p\n", s_pid, size, address);
dbgprintf("==%d== Address is %zu bytes into freed block of size %zu\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace();
dbgprintf("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
dbgprintf("==%d== Later freed at:\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(mallocation->free_backtrace);
return;
}
}
@@ -124,8 +127,11 @@ void MallocTracer::audit_write(FlatPtr address, size_t size)
if (mallocation->freed) {
dbgprintf("\n");
dbgprintf("==%d== \033[31;1mUse-after-free\033[0m, invalid %zu-byte write at address %p\n", s_pid, size, address);
dbgprintf("==%d== Address is %zu bytes into freed block of size %zu\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace();
dbgprintf("==%d== Address is %zu bytes into block of size %zu, allocated at:\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
dbgprintf("==%d== Later freed at:\n", s_pid, offset_into_mallocation, mallocation->size);
Emulator::the().dump_backtrace(mallocation->free_backtrace);
return;
}
}