[scudo] 32-bit quarantine sizes adjustments and bug fixes

[cryptoad]

Summary

The local and global quarantine sizes were not offering a distinction for
32-bit and 64-bit platforms. This is addressed with lower values for 32-bit.

When writing additional tests for the quarantine, it was discovered that when
calling some of the allocator interface function prior to any allocation
operation having occured, the test would crash due to the allocator not being
initialized. This was addressed by making sure the allocator is initialized
for those scenarios.

Relevant tests were added in interface.cpp and quarantine.cpp.

Last change being the removal of the extraneous link dependencies for the
tests thanks to rL293220, anf the addition of the gc-sections linker flag.

[cryptoad]

Test update.

[alekseyshl]

lib/scudo/scudo_flags.cpp

71

So, scudo default quarantine size is less than asan's one? Is there a reason?

test/scudo/quarantine.cpp

55

Wouldn't assert(CONDITION); be more debug friendly than if (!CONDITION) return 1; throughout? Should any of those tests break, to figure out what exactly went wrong, one will have to either step through the code or add printfs/asserts anyway.

[cryptoad]

lib/scudo/scudo_flags.cpp

71

The main reason being that the additional memory footprint incurred by the allocator should remain acceptable.
The ASan default of 256MB is, in my opinion, somewhat crippling. We just want the chunks to not be available right away, but if an attacker has the ability to allocate 64MB to get his chunk back, then he'll likely be able to allocate 256MB as well (to be faire 64MB is arbitrary, it could be less, but it feels like a decent number).

test/scudo/quarantine.cpp

55

Good point, I will change those.

[cryptoad]

Update the tests to use asserts in error path to make failures clearer.

[cryptoad]

Ensure that NDEBUG is undefined via the -UNDEBUG command line flag.

[alekseyshl]

LGTM

lib/scudo/scudo_allocator.cpp

AllocatorQuarantine.Init(
         static_cast<uptr>(Options.QuarantineSizeMb) << 20,
         static_cast<uptr>(Options.ThreadLocalQuarantineSizeKb) << 10);
     BackendAllocator.InitCache(&FallbackAllocatorCache);
     Cookie = Prng.Next();
   }
 
   // Helper function that checks for a valid Scudo chunk.
   bool isValidPointer(const void *UserPtr) {
+    if (UNLIKELY(!ThreadInited))
+      initThread();
     uptr ChunkBeg = reinterpret_cast<uptr>(UserPtr);
     if (!IsAligned(ChunkBeg, MinAlignment)) {
       return false;
     }
     ScudoChunk *Chunk =
         reinterpret_cast<ScudoChunk *>(ChunkBeg - AlignedChunkHeaderSize);
     return Chunk->isValid();
   }
if (!ZeroContents && Ptr && BackendAllocator.FromPrimary(Ptr))
       memset(Ptr, 0, getUsableSize(Ptr));
     return Ptr;
   }
 
   void drainQuarantine() {
     AllocatorQuarantine.Drain(&ThreadQuarantineCache,
                               QuarantineCallback(&Cache));
   }
+
+  uptr getStats(AllocatorStat StatType) {
+    if (UNLIKELY(!ThreadInited))
+      initThread();
+    uptr stats[AllocatorStatCount];
+    BackendAllocator.GetStats(stats);
+    return stats[StatType];
+  }
 };
 
 static Allocator Instance(LINKER_INITIALIZED);
 
 static ScudoAllocator &getAllocator() {
   return Instance.BackendAllocator;
 }
 

 
 }  // namespace __scudo
 
 using namespace __scudo;
 
 // MallocExtension helper functions
 
 uptr __sanitizer_get_current_allocated_bytes() {
-  uptr stats[AllocatorStatCount];
-  getAllocator().GetStats(stats);
-  return stats[AllocatorStatAllocated];
+  return Instance.getStats(AllocatorStatAllocated);
 }
 
 uptr __sanitizer_get_heap_size() {
-  uptr stats[AllocatorStatCount];
-  getAllocator().GetStats(stats);
-  return stats[AllocatorStatMapped];
+  return Instance.getStats(AllocatorStatMapped);
 }
 
 uptr __sanitizer_get_free_bytes() {
   return 1;
 }
 
 uptr __sanitizer_get_unmapped_bytes() {
   return 1;

lib/scudo/scudo_flags.cpp

void initFlags() {
   // Override from environment.
   ScudoParser.ParseString(GetEnv("SCUDO_OPTIONS"));
 
   InitializeCommonFlags();
 
   // Sanity checks and default settings for the Quarantine parameters.
 
   if (f->QuarantineSizeMb < 0) {
-    const int DefaultQuarantineSizeMb = 64;
+    const int DefaultQuarantineSizeMb = FIRST_32_SECOND_64(16, 64);
     f->QuarantineSizeMb = DefaultQuarantineSizeMb;
   }
   // We enforce an upper limit for the quarantine size of 4Gb.
   if (f->QuarantineSizeMb > (4 * 1024)) {
     dieWithMessage("ERROR: the quarantine size is too large\n");
   }
   if (f->ThreadLocalQuarantineSizeKb < 0) {
-    const int DefaultThreadLocalQuarantineSizeKb = 1024;
+    const int DefaultThreadLocalQuarantineSizeKb =
+        FIRST_32_SECOND_64(256, 1024);
     f->ThreadLocalQuarantineSizeKb = DefaultThreadLocalQuarantineSizeKb;
   }
   // And an upper limit of 128Mb for the thread quarantine cache.
   if (f->ThreadLocalQuarantineSizeKb > (128 * 1024)) {
     dieWithMessage("ERROR: the per thread quarantine cache size is too "
                    "large\n");
   }
+  if (f->ThreadLocalQuarantineSizeKb == 0 && f->QuarantineSizeMb > 0) {
+    dieWithMessage("ERROR: ThreadLocalQuarantineSizeKb can be set to 0 only "
+                   "when QuarantineSizeMb is set to 0\n");
+  }
 }
 
 Flags *getFlags() {
   return &ScudoFlags;
 }
 
 }  // namespace __scudo

lib/scudo/scudo_flags.inc

 /// Hardened Allocator runtime flags.
 ///
 //===----------------------------------------------------------------------===//
 
 #ifndef SCUDO_FLAG
 # error "Define SCUDO_FLAG prior to including this file!"
 #endif
 
-SCUDO_FLAG(int, QuarantineSizeMb, 64,
+// Default value is set in scudo_flags.cpp based on architecture.
+SCUDO_FLAG(int, QuarantineSizeMb, -1,
            "Size (in Mb) of quarantine used to delay the actual deallocation "
            "of chunks. Lower value may reduce memory usage but decrease the "
            "effectiveness of the mitigation.")
 
-SCUDO_FLAG(int, ThreadLocalQuarantineSizeKb, 1024,
+// Default value is set in scudo_flags.cpp based on architecture.
+SCUDO_FLAG(int, ThreadLocalQuarantineSizeKb, -1,
           "Size (in Kb) of per-thread cache used to offload the global "
           "quarantine. Lower value may reduce memory usage but might increase "
           "the contention on the global quarantine.")
 
 SCUDO_FLAG(bool, DeallocationTypeMismatch, true,
           "Report errors on malloc/delete, new/free, new/delete[], etc.")
 
 SCUDO_FLAG(bool, DeleteSizeMismatch, true,
            "Report errors on mismatch between size of new and delete.")
 
 SCUDO_FLAG(bool, ZeroContents, false,
           "Zero chunk contents on allocation and deallocation.")

test/scudo/alignment.cpp

 // RUN: %clang_scudo %s -o %t
 // RUN: not %run %t pointers 2>&1 | FileCheck %s
 
 // Tests that a non MinAlignment aligned pointer will trigger the associated
 // error on deallocation.
 
 #include <assert.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 
 int main(int argc, char **argv)
 {
   assert(argc == 2);
   if (!strcmp(argv[1], "pointers")) {
     void *p = malloc(1U << 16);
-    if (!p)
-      return 1;
+    assert(p);
     free(reinterpret_cast<void *>(reinterpret_cast<uintptr_t>(p) | 1));
   }
   return 0;
 }
 
 // CHECK: ERROR: attempted to deallocate a chunk not properly aligned

test/scudo/double-free.cpp

 #include <stdlib.h>
 #include <string.h>
 
 int main(int argc, char **argv)
 {
   assert(argc == 2);
   if (!strcmp(argv[1], "malloc")) {
     void *p = malloc(sizeof(int));
-    if (!p)
-      return 1;
+    assert(p);
     free(p);
     free(p);
   }
   if (!strcmp(argv[1], "new")) {
     int *p = new int;
-    if (!p)
-      return 1;
+    assert(p);
     delete p;
     delete p;
   }
   if (!strcmp(argv[1], "newarray")) {
     int *p = new int[8];
-    if (!p)
-      return 1;
+    assert(p);
     delete[] p;
     delete[] p;
   }
   if (!strcmp(argv[1], "memalign")) {
     void *p = nullptr;
     posix_memalign(&p, 0x100, sizeof(int));
-    if (!p)
-      return 1;
+    assert(p);
     free(p);
     free(p);
   }
   return 0;
 }
 
 // CHECK: ERROR: invalid chunk state

test/scudo/interface.cpp

 // RUN: %clang_scudo %s -lstdc++ -o %t
-// RUN: %run %t 2>&1
+// RUN: %run %t ownership          2>&1
+// RUN: %run %t ownership-and-size 2>&1
+// RUN: %run %t heap-size          2>&1
 
 // Tests that the sanitizer interface functions behave appropriately.
 
 #include <stdlib.h>
+#include <assert.h>
+#include <string.h>
 
 #include <vector>
 
 #include <sanitizer/allocator_interface.h>
 
 int main(int argc, char **argv)
 {
+  assert(argc == 2);
+
+  if (!strcmp(argv[1], "ownership")) {
+    // Ensures that __sanitizer_get_ownership can be called before any other
+    // allocator function, and that it behaves properly on a pointer not owned
+    // by us.
+    assert(!__sanitizer_get_ownership(argv));
+  }
+  if (!strcmp(argv[1], "ownership-and-size")) {
+    // Tests that __sanitizer_get_ownership and __sanitizer_get_allocated_size
+    // behave properly on chunks allocated by the Primary and Secondary.
     void *p;
     std::vector<ssize_t> sizes{1, 8, 16, 32, 1024, 32768,
       1 << 16, 1 << 17, 1 << 20, 1 << 24};
     for (size_t size : sizes) {
       p = malloc(size);
-    if (!p)
-      return 1;
-    if (!__sanitizer_get_ownership(p))
-      return 1;
-    if (__sanitizer_get_allocated_size(p) < size)
-      return 1;
+      assert(p);
+      assert(__sanitizer_get_ownership(p));
+      assert(__sanitizer_get_allocated_size(p) >= size);
       free(p);
     }
+  }
+  if (!strcmp(argv[1], "heap-size")) {
+    // Ensures that __sanitizer_get_heap_size can be called before any other
+    // allocator function. At this point, this heap size should be 0.
+    assert(__sanitizer_get_heap_size() == 0);
+  }
+
   return 0;
 }

test/scudo/lit.cfg

 whole_archive = "-Wl,-whole-archive %s -Wl,-no-whole-archive " % base_lib
 
 # Test suffixes.
 config.suffixes = ['.c', '.cc', '.cpp']
 
 # C flags.
 c_flags = ([config.target_cflags] +
            ["-std=c++11",
-           "-lrt",
-           "-ldl",
            "-pthread",
            "-fPIE",
            "-pie",
-           "-O0"])
+           "-O0",
+           "-UNDEBUG",
+           "-Wl,--gc-sections"])
 
 def build_invocation(compile_flags):                                            
   return " " + " ".join([config.clang] + compile_flags) + " "                   
 
 # Add clang substitutions.
 config.substitutions.append( ("%clang_scudo ",
                               build_invocation(c_flags) + whole_archive) )
 
 # Hardened Allocator tests are currently supported on Linux only.
 if config.host_os not in ['Linux']:
    config.unsupported = True

test/scudo/malloc.cpp

 // RUN: %clang_scudo %s -lstdc++ -o %t
 // RUN: %run %t 2>&1
 
 // Tests that a regular workflow of allocation, memory fill and free works as
 // intended. Tests various sizes serviced by the primary and secondary
 // allocators.
 
+#include <assert.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include <vector>
 
 int main(int argc, char **argv)
 {
   void *p;
   std::vector<ssize_t> sizes{1, 8, 16, 32, 1024, 32768,
     1 << 16, 1 << 17, 1 << 20, 1 << 24};
   std::vector<int> offsets{1, 0, -1, -7, -8, -15, -16, -31, -32};
 
   p = malloc(0);
-  if (!p)
-    return 1;
+  assert(p);
   free(p);
   for (ssize_t size : sizes) {
     for (int offset: offsets) {
       ssize_t actual_size = size + offset;
       if (actual_size <= 0)
         continue;
       p = malloc(actual_size);
-      if (!p)
-        return 1;
+      assert(p);
       memset(p, 0xff, actual_size);
       free(p);
     }
   }
 
   return 0;
 }

test/scudo/memalign.cpp

int main(int argc, char **argv)
   void *p = nullptr;
   size_t alignment = 1U << 12;
   size_t size = 1U << 12;
 
   assert(argc == 2);
 
   if (!strcmp(argv[1], "valid")) {
     posix_memalign(&p, alignment, size);
-    if (!p)
-      return 1;
+    assert(p);
     free(p);
     p = aligned_alloc(alignment, size);
-    if (!p)
-      return 1;
+    assert(p);
     free(p);
     // Tests various combinations of alignment and sizes
     for (int i = (sizeof(void *) == 4) ? 3 : 4; i < 19; i++) {
       alignment = 1U << i;
       for (int j = 1; j < 33; j++) {
         size = 0x800 * j;
         for (int k = 0; k < 3; k++) {
           p = memalign(alignment, size - (2 * sizeof(void *) * k));
-          if (!p)
-            return 1;
+          assert(p);
           free(p);
         }
       }
     }
     // For larger alignment, reduce the number of allocations to avoid running
     // out of potential addresses (on 32-bit).
     for (int i = 19; i <= 24; i++) {
       for (int k = 0; k < 3; k++) {
         p = memalign(alignment, 0x1000 - (2 * sizeof(void *) * k));
-        if (!p)
-          return 1;
+        assert(p);
         free(p);
       }
     }
   }
   if (!strcmp(argv[1], "invalid")) {
     p = memalign(alignment - 1, size);
     free(p);
   }
   return 0;
 }
 
 // CHECK: ERROR: alignment is not a power of 2

test/scudo/mismatch.cpp

 // RUN: %clang_scudo %s -o %t
 // RUN: SCUDO_OPTIONS=DeallocationTypeMismatch=1 not %run %t mallocdel   2>&1 | FileCheck %s
 // RUN: SCUDO_OPTIONS=DeallocationTypeMismatch=0     %run %t mallocdel   2>&1
 // RUN: SCUDO_OPTIONS=DeallocationTypeMismatch=1 not %run %t newfree     2>&1 | FileCheck %s
 // RUN: SCUDO_OPTIONS=DeallocationTypeMismatch=0     %run %t newfree     2>&1
 // RUN: SCUDO_OPTIONS=DeallocationTypeMismatch=1 not %run %t memaligndel 2>&1 | FileCheck %s
 // RUN: SCUDO_OPTIONS=DeallocationTypeMismatch=0     %run %t memaligndel 2>&1
 
 // Tests that type mismatches between allocation and deallocation functions are
 // caught when the related option is set.
 
 #include <assert.h>
+#include <malloc.h>
 #include <stdlib.h>
 #include <string.h>
-#include <malloc.h>
 
 int main(int argc, char **argv)
 {
   assert(argc == 2);
   if (!strcmp(argv[1], "mallocdel")) {
     int *p = (int *)malloc(16);
-    if (!p)
-      return 1;
+    assert(p);
     delete p;
   }
   if (!strcmp(argv[1], "newfree")) {
     int *p = new int;
-    if (!p)
-      return 1;
+    assert(p);
     free((void *)p);
   }
   if (!strcmp(argv[1], "memaligndel")) {
     int *p = (int *)memalign(16, 16);
-    if (!p)
-      return 1;
+    assert(p);
     delete p;
   }
   return 0;
 }
 
 // CHECK: ERROR: allocation type mismatch on address

test/scudo/options.cpp

 // RUN: %clang_scudo %s -o %t
 // RUN:                                              %run %t 2>&1
 // RUN: SCUDO_OPTIONS=DeallocationTypeMismatch=0     %run %t 2>&1
 // RUN: SCUDO_OPTIONS=DeallocationTypeMismatch=1 not %run %t 2>&1 | FileCheck %s
 
 // Tests that the options can be passed using getScudoDefaultOptions, and that
 // the environment ones take precedence over them.
 
-#include <stdlib.h>
+#include <assert.h>
 #include <malloc.h>
+#include <stdlib.h>
 
 extern "C" const char* __scudo_default_options() {
   return "DeallocationTypeMismatch=0";  // Defaults to true in scudo_flags.inc.
 }
 
 int main(int argc, char **argv)
 {
   int *p = (int *)malloc(16);
-  if (!p)
-    return 1;
+  assert(p);
   delete p;
   return 0;
 }
 
 // CHECK: ERROR: allocation type mismatch on address

test/scudo/overflow.cpp

 // RUN: %clang_scudo %s -o %t
 // RUN:                                  not %run %t malloc     2>&1 | FileCheck %s
 // RUN: SCUDO_OPTIONS=QuarantineSizeMb=1 not %run %t quarantine 2>&1 | FileCheck %s
 
 // Tests that header corruption of an allocated or quarantined chunk is caught.
 
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
 
 int main(int argc, char **argv)
 {
-  assert(argc == 2);
   ssize_t offset = sizeof(void *) == 8 ? 8 : 0;
+
+  assert(argc == 2);
+
   if (!strcmp(argv[1], "malloc")) {
     // Simulate a header corruption of an allocated chunk (1-bit)
     void *p = malloc(1U << 4);
-    if (!p)
-      return 1;
+    assert(p);
     ((char *)p)[-(offset + 1)] ^= 1;
     free(p);
   }
   if (!strcmp(argv[1], "quarantine")) {
     void *p = malloc(1U << 4);
-    if (!p)
-      return 1;
+    assert(p);
     free(p);
     // Simulate a header corruption of a quarantined chunk
     ((char *)p)[-(offset + 2)] ^= 1;
     // Trigger the quarantine recycle
     for (int i = 0; i < 0x100; i++) {
       p = malloc(1U << 16);
       free(p);
     }
   }
   return 0;
 }
 
 // CHECK: ERROR: corrupted chunk header at address

test/scudo/preinit.cpp

 // RUN: %clang_scudo %s -o %t
 // RUN: %run %t 2>&1
 
 // Verifies that calling malloc in a preinit_array function succeeds, and that
 // the resulting pointer can be freed at program termination.
 
+#include <assert.h>
 #include <stdlib.h>
 #include <string.h>
 
 static void *global_p = nullptr;
 
 void __init(void) {
   global_p = malloc(1);
   if (!global_p)
     exit(1);
 }
 
 void __fini(void) {
   if (global_p)
     free(global_p);
 }
 
 int main(int argc, char **argv)
 {
   void *p = malloc(1);
-  if (!p)
-    return 1;
+  assert(p);
   free(p);
 
   return 0;
 }
 
 __attribute__((section(".preinit_array"), used))
   void (*__local_preinit)(void) = __init;
 __attribute__((section(".fini_array"), used))
   void (*__local_fini)(void) = __fini;
-

test/scudo/quarantine.cpp

 // RUN: %clang_scudo %s -o %t
-// RUN: SCUDO_OPTIONS=QuarantineSizeMb=1 %run %t 2>&1
+// RUN: SCUDO_OPTIONS="QuarantineSizeMb=0:ThreadLocalQuarantineSizeKb=0" %run %t zeroquarantine 2>&1
+// RUN: SCUDO_OPTIONS=QuarantineSizeMb=1                                 %run %t smallquarantine 2>&1
 
 // Tests that the quarantine prevents a chunk from being reused right away.
 // Also tests that a chunk will eventually become available again for
 // allocation when the recycling criteria has been met.
 
+#include <assert.h>
 #include <malloc.h>
 #include <stdlib.h>
 #include <string.h>
 
+#include <sanitizer/allocator_interface.h>
+
 int main(int argc, char **argv)
 {
   void *p, *old_p;
-  size_t size = 1U << 16;
+  size_t allocated_bytes, size = 1U << 16;
+
+  assert(argc == 2);
 
-  // The delayed freelist will prevent a chunk from being available right away
+  if (!strcmp(argv[1], "zeroquarantine")) {
+    // Verifies that a chunk is deallocated right away when the local and
+    // global quarantine sizes are 0.
+    allocated_bytes = __sanitizer_get_current_allocated_bytes();
+    p = malloc(size);
+    assert(p);
+    assert(__sanitizer_get_current_allocated_bytes() > allocated_bytes);
+    free(p);
+    assert(__sanitizer_get_current_allocated_bytes() == allocated_bytes);
+  }
+  if (!strcmp(argv[1], "smallquarantine")) {
+    // The delayed freelist will prevent a chunk from being available right
+    // away.
     p = malloc(size);
-  if (!p)
-    return 1;
+    assert(p);
     old_p = p;
     free(p);
     p = malloc(size);
-  if (!p)
-    return 1;
-  if (old_p == p)
-    return 1;
+    assert(p);
+    assert(old_p != p);
     free(p);
 
-  // Eventually the chunk should become available again
+    // Eventually the chunk should become available again.
     bool found = false;
     for (int i = 0; i < 0x100 && found == false; i++) {
       p = malloc(size);
-    if (!p)
-      return 1;
+      assert(p);
       found = (p == old_p);
       free(p);
     }
-  if (found == false)
-    return 1;
+    assert(found == true);
+  }
 
   return 0;
 }

test/scudo/realloc.cpp

 
 int main(int argc, char **argv)
 {
   void *p, *old_p;
   // Those sizes will exercise both allocators (Primary & Secondary).
   std::vector<size_t> sizes{1, 16, 1024, 32768, 1 << 16, 1 << 17, 1 << 20};
 
   assert(argc == 2);
+
   for (size_t size : sizes) {
     if (!strcmp(argv[1], "pointers")) {
       old_p = p = realloc(nullptr, size);
-      if (!p)
-        return 1;
+      assert(p);
       size = malloc_usable_size(p);
       // Our realloc implementation will return the same pointer if the size
       // requested is lower than or equal to the usable size of the associated
       // chunk.
       p = realloc(p, size - 1);
-      if (p != old_p)
-        return 1;
+      assert(p == old_p);
       p = realloc(p, size);
-      if (p != old_p)
-        return 1;
+      assert(p == old_p);
       // And a new one if the size is greater.
       p = realloc(p, size + 1);
-      if (p == old_p)
-        return 1;
+      assert(p != old_p);
       // A size of 0 will free the chunk and return nullptr.
       p = realloc(p, 0);
-      if (p)
-        return 1;
+      assert(!p);
       old_p = nullptr;
     }
     if (!strcmp(argv[1], "contents")) {
       p = realloc(nullptr, size);
-      if (!p)
-        return 1;
+      assert(p);
       for (int i = 0; i < size; i++)
         reinterpret_cast<char *>(p)[i] = 'A';
       p = realloc(p, size + 1);
       // The contents of the reallocated chunk must match the original one.
       for (int i = 0; i < size; i++)
-        if (reinterpret_cast<char *>(p)[i] != 'A')
-          return 1;
+        assert(reinterpret_cast<char *>(p)[i] == 'A');
     }
     if (!strcmp(argv[1], "memalign")) {
       // A chunk coming from memalign cannot be reallocated.
       p = memalign(16, size);
-      if (!p)
-        return 1;
+      assert(p);
       p = realloc(p, size);
       free(p);
     }
   }
   return 0;
 }
 
 // CHECK: ERROR: invalid chunk type when reallocating address

test/scudo/secondary.cpp

 // RUN: %clang_scudo %s -o %t
 // RUN: %run %t after  2>&1 | FileCheck %s
 // RUN: %run %t before 2>&1 | FileCheck %s
 
 // Test that we hit a guard page when writing past the end of a chunk
 // allocated by the Secondary allocator, or writing too far in front of it.
 
+#include <assert.h>
 #include <malloc.h>
+#include <signal.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
-#include <signal.h>
-#include <assert.h>
 
 void handler(int signo, siginfo_t *info, void *uctx) {
   if (info->si_code == SEGV_ACCERR) {
     fprintf(stderr, "SCUDO SIGSEGV\n");
     exit(0);
   }
   exit(1);
 }
 
 int main(int argc, char **argv)
 {
   // The size must be large enough to be serviced by the secondary allocator.
   long page_size = sysconf(_SC_PAGESIZE);
   size_t size = (1U << 17) + page_size;
   struct sigaction a;
 
   assert(argc == 2);
   memset(&a, 0, sizeof(a));
   a.sa_sigaction = handler;
   a.sa_flags = SA_SIGINFO;
 
   char *p = (char *)malloc(size);
-  if (!p)
-    return 1;
+  assert(p);
   memset(p, 'A', size); // This should not trigger anything.
   // Set up the SIGSEGV handler now, as the rest should trigger an AV.
   sigaction(SIGSEGV, &a, nullptr);
   if (!strcmp(argv[1], "after")) {
     for (int i = 0; i < page_size; i++)
       p[size + i] = 'A';
   }
   if (!strcmp(argv[1], "before")) {

test/scudo/sized-delete.cpp

 // RUN: %clang_scudo -fsized-deallocation %s -o %t
 // RUN: SCUDO_OPTIONS=DeleteSizeMismatch=1     %run %t gooddel    2>&1
 // RUN: SCUDO_OPTIONS=DeleteSizeMismatch=1 not %run %t baddel     2>&1 | FileCheck %s
 // RUN: SCUDO_OPTIONS=DeleteSizeMismatch=0     %run %t baddel     2>&1
 // RUN: SCUDO_OPTIONS=DeleteSizeMismatch=1     %run %t gooddelarr 2>&1
 // RUN: SCUDO_OPTIONS=DeleteSizeMismatch=1 not %run %t baddelarr  2>&1 | FileCheck %s
 // RUN: SCUDO_OPTIONS=DeleteSizeMismatch=0     %run %t baddelarr  2>&1
 
 // Ensures that the sized delete operator errors out when the appropriate
 // option is passed and the sizes do not match between allocation and
 // deallocation functions.
 
-#include <new>
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
 
+#include <new>
+
 int main(int argc, char **argv)
 {
   assert(argc == 2);
   if (!strcmp(argv[1], "gooddel")) {
     long long *p = new long long;
     operator delete(p, sizeof(long long));
   }
   if (!strcmp(argv[1], "baddel")) {

test/scudo/sizes.cpp

 
 int main(int argc, char **argv)
 {
   assert(argc == 2);
   if (!strcmp(argv[1], "malloc")) {
     // Currently the maximum size the allocator can allocate is 1ULL<<40 bytes.
     size_t size = std::numeric_limits<size_t>::max();
     void *p = malloc(size);
-    if (p)
-      return 1;
+    assert(!p);
     size = (1ULL << 40) - 16;
     p = malloc(size);
-    if (p)
-      return 1;
+    assert(!p);
   }
   if (!strcmp(argv[1], "calloc")) {
     // Trigger an overflow in calloc.
     size_t size = std::numeric_limits<size_t>::max();
     void *p = calloc((size / 0x1000) + 1, 0x1000);
-    if (p)
-      return 1;
+    assert(!p);
   }
   if (!strcmp(argv[1], "usable")) {
     // Playing with the actual usable size of a chunk.
     void *p = malloc(1007);
-    if (!p)
-      return 1;
+    assert(p);
     size_t size = malloc_usable_size(p);
-    if (size < 1007)
-      return 1;
+    assert(size >= 1007);
     memset(p, 'A', size);
     p = realloc(p, 2014);
-    if (!p)
-      return 1;
+    assert(p);
     size = malloc_usable_size(p);
-    if (size < 2014)
-      return 1;
+    assert(size >= 2014);
     memset(p, 'B', size);
     free(p);
   }
   return 0;
 }
 
 // CHECK: allocator is terminating the process