[scudo] Fix an edge case in the secondary allocator

[cryptoad]

Summary

s/CHECK_LT/CHECK_LE/ in the secondary allocator, as under certain circumstances
Ptr + Size can be equal to MapEnd. This edge case was not found by the current
tests, so those were extended to be able to catch that.

[kcc]

LGTM

lib/scudo/scudo_allocator.cpp

struct UnpackedHeader {
   // 1st 8 bytes
   u16 Checksum      : 16;
   u64 RequestedSize : 40; // Needed for reallocation purposes.
   u8  State         : 2;  // available, allocated, or quarantined
   u8  AllocType     : 2;  // malloc, new, new[], or memalign
   u8  Unused_0_     : 4;
   // 2nd 8 bytes
   u64 Offset        : 20; // Offset from the beginning of the backend
-                          // allocation to the beginning chunk itself, in
-                          // multiples of MinAlignment. See comment about its
-                          // maximum value and test in init().
+                          // allocation to the beginning of the chunk itself,
+                          // in multiples of MinAlignment. See comment about
+                          // its maximum value and test in init().
   u64 Unused_1_     : 28;
   u16 Salt          : 16;
 };
 
 COMPILER_CHECK(sizeof(UnpackedHeader) == sizeof(PackedHeader));
 
 const uptr ChunkHeaderSize = sizeof(PackedHeader);
 

lib/scudo/scudo_allocator_secondary.h

void *Allocate(AllocatorStats *Stats, uptr Size, uptr Alignment) {
     // A page-aligned pointer is assumed after that, so check it now.
     CHECK(IsAligned(MapBeg, PageSize));
     MapBeg += PageSize;
     CHECK_EQ(MapBeg, reinterpret_cast<uptr>(MmapFixedOrDie(MapBeg, MapSize)));
     uptr MapEnd = MapBeg + MapSize;
     uptr Ptr = MapBeg + sizeof(SecondaryHeader);
     // TODO(kostyak): add a random offset to Ptr.
     CHECK_GT(Ptr + Size, MapBeg);
-    CHECK_LT(Ptr + Size, MapEnd);
+    CHECK_LE(Ptr + Size, MapEnd);
     SecondaryHeader *Header = getHeader(Ptr);
     Header->MapBeg = MapBeg - PageSize;
     Header->MapSize = MapSize + 2 * PageSize;
     Stats->Add(AllocatorStatAllocated, MapSize);
     Stats->Add(AllocatorStatMapped, MapSize);
     return reinterpret_cast<void *>(Ptr);
   }
 

lib/scudo/scudo_utils.cpp

extern int VSNPrintf(char *buff, int buff_length, const char *format,
                      va_list args);
 
 } // namespace __sanitizer
 
 namespace __scudo {
 
 FORMAT(1, 2)
 void NORETURN dieWithMessage(const char *Format, ...) {
-  // Our messages are tiny, 128 characters is more than enough.
-  char Message[128];
+  // Our messages are tiny, 256 characters is more than enough.
+  char Message[256];
   va_list Args;
   va_start(Args, Format);
   __sanitizer::VSNPrintf(Message, sizeof(Message), Format, Args);
   va_end(Args);
   RawWrite(Message);
   Die();
 }
 

test/scudo/malloc.cpp

 // RUN: %clang_scudo %s -o %t
 // RUN: %run %t 2>&1
 
 // Tests that a regular workflow of allocation, memory fill and free works as
 // intended. Also tests that a zero-sized allocation succeeds.
 
 #include <malloc.h>
 #include <stdlib.h>
 #include <string.h>
 
+#include <vector>
+
 int main(int argc, char **argv)
 {
   void *p;
-  size_t size = 1U << 8;
+  std::vector<size_t> sizes{1, 1 << 5, 1 << 10, 1 << 15, 1 << 20};
 
-  p = malloc(size);
+  p = malloc(0);
   if (!p)
     return 1;
-  memset(p, 'A', size);
   free(p);
-  p = malloc(0);
+  for (size_t size : sizes) {
+    p = malloc(size);
     if (!p)
       return 1;
+    memset(p, 'A', size);
     free(p);
+  }
 
   return 0;
 }

test/scudo/memalign.cpp

 #include <stdlib.h>
 #include <string.h>
 
 // Sometimes the headers may not have this...
 extern "C" void *aligned_alloc (size_t alignment, size_t size);
 
 int main(int argc, char **argv)
 {
-  void *p;
+  void *p = nullptr;
   size_t alignment = 1U << 12;
-  size_t size = alignment;
+  size_t size = 1U << 12;
 
   assert(argc == 2);
+
   if (!strcmp(argv[1], "valid")) {
-    p = memalign(alignment, size);
+    posix_memalign(&p, alignment, size);
     if (!p)
       return 1;
     free(p);
-    p = nullptr;
-    posix_memalign(&p, alignment, size);
+    p = aligned_alloc(alignment, size);
     if (!p)
       return 1;
     free(p);
-    p = aligned_alloc(alignment, size);
+    // Tests various combinations of alignment and sizes
+    for (int i = 4; i < 20; i++) {
+      alignment = 1U << i;
+      for (int j = 1; j < 33; j++) {
+        size = 0x800 * j;
+        for (int k = 0; k < 3; k++) {
+          p = memalign(alignment, size - (16 * k));
           if (!p)
             return 1;
           free(p);
         }
+      }
+    }
+  }
   if (!strcmp(argv[1], "invalid")) {
     p = memalign(alignment - 1, size);
     free(p);
   }
   return 0;
 }
 
 // CHECK: ERROR: malloc alignment is not a power of 2

test/scudo/realloc.cpp

 #include <string.h>
 
 #include <vector>
 
 int main(int argc, char **argv)
 {
   void *p, *old_p;
   // Those sizes will exercise both allocators (Primary & Secondary).
-  std::vector<size_t> sizes{1 << 5, 1 << 17};
+  std::vector<size_t> sizes{1, 1 << 5, 1 << 10, 1 << 15, 1 << 20};
 
   assert(argc == 2);
   for (size_t size : sizes) {
     if (!strcmp(argv[1], "pointers")) {
       old_p = p = realloc(nullptr, size);
       if (!p)
         return 1;
       size = malloc_usable_size(p);
       // Our realloc implementation will return the same pointer if the size
-      // requested is lower or equal to the usable size of the associated chunk.
+      // requested is lower than or equal to the usable size of the associated
+      // chunk.
       p = realloc(p, size - 1);
       if (p != old_p)
         return 1;
       p = realloc(p, size);
       if (p != old_p)
         return 1;
       // And a new one if the size is greater.
       p = realloc(p, size + 1);