[sanitizers][windows] Global/LocalAlloc interception and tests

[mcgov]

Summary

GlobalAlloc and LocalAlloc are windows allocators that are frequently used in some older code bases. This adds interception and tests for those allocators with similar restrictions to the HeapAlloc and RtlHeapAllocate interceptors: moveable memory is not yet supported.

patch by Brijesh Rakholiya <[e-mail]> and Ian Kronquist <[e-mail]>

[mcgov]

clang formatted the patch

[mstorsjo]

compiler-rt/lib/asan/asan_malloc_win.cc

22 ↗

(On Diff #235625)

Removing <stddef.h> here breaks building with mingw, as it's necessary for the size_t type.

If I readd it here, it builds fine for me, but I presume it's removed for a reason?

FWIW, do note that this file is named .cpp in the latest git master; it looks like this diff has been made against an older tree?

Also, it's useful if the uploaded diffs are made with extra context (diff -U999)

[mcgov]

Planning to rebase this patch on master instead of release/9.x

compiler-rt/lib/asan/asan_malloc_win.cc

22 ↗

(On Diff #235625)

Ah yes this was against release/9.x but I will recreate it against master.

[mcgov]

rebased to master

[mstorsjo]

Builds fine in my MinGW configuration now, thanks!

compiler-rt/lib/asan/asan_malloc_win.cpp

407

I'm getting conflicts here when I try to apply the patch locally on master, not sure what that stems from...

[rnk]

compiler-rt/lib/asan/asan_malloc_win.cpp

57

I guess I prefer the spelling __declspec, since it's in the implementer's namespace.

95

Most of the changes in this file are from clang-format. I don't mind a few, but this is too many. Can you revert the non-functional whitespace changes far from the code you are editing? You can use git checkout -p to speed this up.

I also encourage you to run run check-sanitizer on Linux. The ASan codebase has its own linter script that doesn't run on Windows, and sometimes disagrees with clang-format.

compiler-rt/lib/interception/interception_win.cpp

524

So far this seems like the only functional change in this file.

compiler-rt/test/asan/TestCases/Windows/globalalloc_flags_fallback.cpp

4

What is the main blocker for making these tests work for 64-bit? Fixing the hotpatching interceptors?

Chromium stopped using 32-bit ASan because the address space limitations were prohibitive. I think the sanitizer-windows bot only builds x64 these days, so if we can port these, that would help make sure they are covered.

[mcgov]

compiler-rt/lib/asan/asan_malloc_win.cpp

95

I can do all this when I reactivate the review. I'm going to abandon this one for now and return to the Global/Local Alloc work after a few other changes are submitted.

We have a set of patches that will fix
a) the cmake issues causing both the asan and asan_dynamic libs to be built with MT.
b) Interceptor issues preventing us from supporting _DEBUG runtimes
c) remove dependence on HeapValidate for control-flow in these interceptors since it throws debug breakpoints under a debugger when the result is false (and that function also throws assertions with M[TD]d).

After some discussion with @iakronqu I'm going to pull this review for now and add these interceptors back until after these other patches are submitted.

compiler-rt/lib/asan/asan_malloc_win.cpp

 
 // Intentionally not including windows.h here, to avoid the risk of
 // pulling in conflicting declarations of these functions. (With mingw-w64,
 // there's a risk of windows.h pulling in stdint.h.)
 typedef int BOOL;
 typedef void *HANDLE;
 typedef const void *LPCVOID;
 typedef void *LPVOID;
+typedef HANDLE HWND;
+typedef HANDLE HGLOBAL;
+typedef HANDLE HLOCAL;
+typedef unsigned int UINT;
 
 typedef unsigned long DWORD;
 constexpr unsigned long HEAP_ZERO_MEMORY = 0x00000008;
 constexpr unsigned long HEAP_REALLOC_IN_PLACE_ONLY = 0x00000010;
 constexpr unsigned long HEAP_ALLOCATE_SUPPORTED_FLAGS = (HEAP_ZERO_MEMORY);
 constexpr unsigned long HEAP_ALLOCATE_UNSUPPORTED_FLAGS =
     (~HEAP_ALLOCATE_SUPPORTED_FLAGS);
 constexpr unsigned long HEAP_FREE_UNSUPPORTED_FLAGS =
     (~HEAP_ALLOCATE_SUPPORTED_FLAGS);
 constexpr unsigned long HEAP_REALLOC_UNSUPPORTED_FLAGS =
     (~HEAP_ALLOCATE_SUPPORTED_FLAGS);
 
-
 extern "C" {
 LPVOID WINAPI HeapAlloc(HANDLE hHeap, DWORD dwFlags, size_t dwBytes);
 LPVOID WINAPI HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem,
                           size_t dwBytes);
 BOOL WINAPI HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
 size_t WINAPI HeapSize(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem);
 
 BOOL WINAPI HeapValidate(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem);
+HANDLE WINAPI GetProcessHeap();
+
+_declspec(dllimport) HGLOBAL WINAPI GlobalAlloc(UINT uFlags, SIZE_T dwBytes);
+_declspec(dllimport) HGLOBAL WINAPI GlobalFree(HGLOBAL hMem);
+_declspec(dllimport) HGLOBAL WINAPI GlobalSize(HGLOBAL hMem);
+_declspec(dllimport) HGLOBAL WINAPI
+    GlobalReAlloc(HGLOBAL hMem, SIZE_T dwBytes, UINT uFlags);
+_declspec(dllimport) HGLOBAL WINAPI GlobalLock(HGLOBAL hMem);
+_declspec(dllimport) HGLOBAL WINAPI GlobalUnlock(HGLOBAL hMem);
+_declspec(dllimport) HLOCAL WINAPI LocalAlloc(UINT uFlags, SIZE_T dwBytes);
+_declspec(dllimport) HLOCAL WINAPI LocalFree(HLOCAL hMem);
+_declspec(dllimport) HLOCAL WINAPI LocalSize(HLOCAL hMem);
+_declspec(dllimport) HLOCAL WINAPI
+    LocalReAlloc(HLOCAL hMem, size_t dwBytes, UINT uFlags);
+_declspec(dllimport) HLOCAL WINAPI LocalLock(HLOCAL hMem);
+_declspec(dllimport) HLOCAL WINAPI LocalUnlock(HLOCAL hMem);
 }
 
 using namespace __asan;
 
 // MT: Simply defining functions with the same signature in *.obj
 // files overrides the standard functions in the CRT.
 // MD: Memory allocation functions are defined in the CRT .dll,
 // so we have to intercept them before they are called for the first time.
 
 #if ASAN_DYNAMIC
-# define ALLOCATION_FUNCTION_ATTRIBUTE
+#define ALLOCATION_FUNCTION_ATTRIBUTE
 #else
-# define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
+#define ALLOCATION_FUNCTION_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE
 #endif
 
 extern "C" {
 ALLOCATION_FUNCTION_ATTRIBUTE
 size_t _msize(void *ptr) {
   GET_CURRENT_PC_BP_SP;
   (void)sp;
   return asan_malloc_usable_size(ptr, pc, bp);
 }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
-size_t _msize_base(void *ptr) {
-  return _msize(ptr);
-}
+size_t _msize_base(void *ptr) { return _msize(ptr); }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
 void free(void *ptr) {
   GET_STACK_TRACE_FREE;
   return asan_free(ptr, &stack, FROM_MALLOC);
 }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
-void _free_dbg(void *ptr, int) {
-  free(ptr);
-}
+void _free_dbg(void *ptr, int) { free(ptr); }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
-void _free_base(void *ptr) {
-  free(ptr);
-}
+void _free_base(void *ptr) { free(ptr); }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
 void *malloc(size_t size) {
   GET_STACK_TRACE_MALLOC;
   return asan_malloc(size, &stack);
 }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
-void *_malloc_base(size_t size) {
-  return malloc(size);
-}
+void *_malloc_base(size_t size) { return malloc(size); }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
-void *_malloc_dbg(size_t size, int, const char *, int) {
-  return malloc(size);
-}
+void *_malloc_dbg(size_t size, int, const char *, int) { return malloc(size); }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
 void *calloc(size_t nmemb, size_t size) {
   GET_STACK_TRACE_MALLOC;
   return asan_calloc(nmemb, size, &stack);
 }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
-void *_calloc_base(size_t nmemb, size_t size) {
-  return calloc(nmemb, size);
-}
+void *_calloc_base(size_t nmemb, size_t size) { return calloc(nmemb, size); }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
 void *_calloc_dbg(size_t nmemb, size_t size, int, const char *, int) {
   return calloc(nmemb, size);
 }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
 void *_calloc_impl(size_t nmemb, size_t size, int *errno_tmp) {
   return calloc(nmemb, size);
 }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
 void *realloc(void *ptr, size_t size) {
   GET_STACK_TRACE_MALLOC;
   return asan_realloc(ptr, size, &stack);
 }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
 void *_realloc_dbg(void *ptr, size_t size, int) {
   UNREACHABLE("_realloc_dbg should not exist!");
   return 0;
 }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
-void *_realloc_base(void *ptr, size_t size) {
-  return realloc(ptr, size);
-}
+void *_realloc_base(void *ptr, size_t size) { return realloc(ptr, size); }
 
 ALLOCATION_FUNCTION_ATTRIBUTE
 void *_recalloc(void *p, size_t n, size_t elem_size) {
   if (!p)
     return calloc(n, elem_size);
   const size_t size = n * elem_size;
   if (elem_size != 0 && size / elem_size != n)
     return 0;

 ALLOCATION_FUNCTION_ATTRIBUTE
 void *_expand_dbg(void *memblock, size_t size) {
   return _expand(memblock, size);
 }
 
 // TODO(timurrrr): Might want to add support for _aligned_* allocation
 // functions to detect a bit more bugs.  Those functions seem to wrap malloc().
 
-int _CrtDbgReport(int, const char*, int,
-                  const char*, const char*, ...) {
+int _CrtDbgReport(int, const char *, int, const char *, const char *, ...) {
   ShowStatsAndAbort();
 }
 
-int _CrtDbgReportW(int reportType, const wchar_t*, int,
-                   const wchar_t*, const wchar_t*, ...) {
+int _CrtDbgReportW(int reportType, const wchar_t *, int, const wchar_t *,
+                   const wchar_t *, ...) {
   ShowStatsAndAbort();
 }
 
-int _CrtSetReportMode(int, int) {
-  return 0;
-}
+int _CrtSetReportMode(int, int) { return 0; }
 }  // extern "C"
 
 #define OWNED_BY_RTL(heap, memory) \
   (!__sanitizer_get_ownership(memory) && HeapValidate(heap, 0, memory))
 
 INTERCEPTOR_WINAPI(size_t, HeapSize, HANDLE hHeap, DWORD dwFlags,
                    LPCVOID lpMem) {
   // If the RTL allocators are hooked we need to check whether the ASAN
if (flags()->windows_hook_rtl_allocators) {
 
     if (ownershipState == ASAN && !only_asan_supported_flags) {
       // Conversion to unsupported flags allocation,
       // transfer this allocation back to the original allocator.
       void *replacement_alloc = allocFunc(hHeap, dwFlags, dwBytes);
       size_t old_usable_size = 0;
       if (replacement_alloc) {
         old_usable_size = asan_malloc_usable_size(lpMem, pc, bp);
-        REAL(memcpy)(replacement_alloc, lpMem,
-                     Min<size_t>(dwBytes, old_usable_size));
+        REAL(memcpy)
+        (replacement_alloc, lpMem, Min<size_t>(dwBytes, old_usable_size));
         asan_free(lpMem, &stack, FROM_MALLOC);
       }
       return replacement_alloc;
     }
 
     CHECK((ownershipState == ASAN || ownershipState == NEITHER) &&
           only_asan_supported_flags);
     // At this point we should either be ASAN owned with ASAN supported flags

 // However, hooking them is necessary to hook Windows heap
 // allocations with detours and their definitions are unlikely to change.
 // Comments in /minkernel/ntos/rtl/heappublic.c indicate that these functions
 // are part of the heap's public interface.
 typedef unsigned long LOGICAL;
 
 // This function is documented as part of the Driver Development Kit but *not*
 // the Windows Development Kit.
-LOGICAL RtlFreeHeap(void* HeapHandle, DWORD Flags,
-                            void* BaseAddress);
+LOGICAL RtlFreeHeap(void *HeapHandle, DWORD Flags, void *BaseAddress);
 
 // This function is documented as part of the Driver Development Kit but *not*
 // the Windows Development Kit.
-void* RtlAllocateHeap(void* HeapHandle, DWORD Flags, size_t Size);
+void *RtlAllocateHeap(void *HeapHandle, DWORD Flags, size_t Size);
 
 // This function is completely undocumented.
-void*
-RtlReAllocateHeap(void* HeapHandle, DWORD Flags, void* BaseAddress,
+void *RtlReAllocateHeap(void *HeapHandle, DWORD Flags, void *BaseAddress,
                         size_t Size);
 
 // This function is completely undocumented.
-size_t RtlSizeHeap(void* HeapHandle, DWORD Flags, void* BaseAddress);
+size_t RtlSizeHeap(void *HeapHandle, DWORD Flags, void *BaseAddress);
 
 INTERCEPTOR_WINAPI(size_t, RtlSizeHeap, HANDLE HeapHandle, DWORD Flags,
-                   void* BaseAddress) {
+                   void *BaseAddress) {
   if (!flags()->windows_hook_rtl_allocators ||
       UNLIKELY(!asan_inited || OWNED_BY_RTL(HeapHandle, BaseAddress))) {
     return REAL(RtlSizeHeap)(HeapHandle, Flags, BaseAddress);
   }
   GET_CURRENT_PC_BP_SP;
   (void)sp;
   return asan_malloc_usable_size(BaseAddress, pc, bp);
 }
 
 INTERCEPTOR_WINAPI(BOOL, RtlFreeHeap, HANDLE HeapHandle, DWORD Flags,
-                   void* BaseAddress) {
+                   void *BaseAddress) {
   // Heap allocations happen before this function is hooked, so we must fall
   // back to the original function if the pointer is not from the ASAN heap, or
   // unsupported flags are provided.
   if (!flags()->windows_hook_rtl_allocators ||
       UNLIKELY((HEAP_FREE_UNSUPPORTED_FLAGS & Flags) != 0 ||
                OWNED_BY_RTL(HeapHandle, BaseAddress))) {
     return REAL(RtlFreeHeap)(HeapHandle, Flags, BaseAddress);
   }
   GET_STACK_TRACE_FREE;
   asan_free(BaseAddress, &stack, FROM_MALLOC);
   return true;
 }
 
-INTERCEPTOR_WINAPI(void*, RtlAllocateHeap, HANDLE HeapHandle, DWORD Flags,
+INTERCEPTOR_WINAPI(void *, RtlAllocateHeap, HANDLE HeapHandle, DWORD Flags,
                    size_t Size) {
   // If the ASAN runtime is not initialized, or we encounter an unsupported
   // flag, fall back to the original allocator.
   if (!flags()->windows_hook_rtl_allocators ||
       UNLIKELY(!asan_inited ||
                (Flags & HEAP_ALLOCATE_UNSUPPORTED_FLAGS) != 0)) {
     return REAL(RtlAllocateHeap)(HeapHandle, Flags, Size);
   }
   GET_STACK_TRACE_MALLOC;
   void *p;
   // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
   // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
   // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
   if (Flags & HEAP_ZERO_MEMORY) {
     p = asan_calloc(Size, 1, &stack);
   } else {
     p = asan_malloc(Size, &stack);
   }
   return p;
 }
 
-INTERCEPTOR_WINAPI(void*, RtlReAllocateHeap, HANDLE HeapHandle, DWORD Flags,
-                   void* BaseAddress, size_t Size) {
+INTERCEPTOR_WINAPI(void *, RtlReAllocateHeap, HANDLE HeapHandle, DWORD Flags,
+                   void *BaseAddress, size_t Size) {
   // If it's actually a heap block which was allocated before the ASAN runtime
   // came up, use the real RtlFreeHeap function.
   if (!flags()->windows_hook_rtl_allocators)
     return REAL(RtlReAllocateHeap)(HeapHandle, Flags, BaseAddress, Size);
 
   return SharedReAlloc(REAL(RtlReAllocateHeap), REAL(RtlSizeHeap),
                        REAL(RtlFreeHeap), REAL(RtlAllocateHeap), HeapHandle,
                        Flags, BaseAddress, Size);
 }
 
+// FIXED and ZEROINIT correspond to LMEM_FIXED/GMEM_FIXED
+// and LMEM_ZEROINIT/GMEM_ZEROINIT (as provided in the documentation).
+// In case, if these values change then FIXED and ZEROINIT
+// will have to be updated accordingly.
+#define FIXED 0x0000
+#define ZEROINIT 0x0040
+
+constexpr unsigned long SHARED_ALLOC_SUPPORTED_FLAGS = (FIXED | ZEROINIT);
+constexpr unsigned long SHARED_ALLOC_UNSUPPORTED_FLAGS =
+    (~SHARED_ALLOC_SUPPORTED_FLAGS);
+
+INTERCEPTOR_WINAPI(HGLOBAL, GlobalAlloc, UINT uFlags, SIZE_T dwBytes) {
+  // If we encounter an unsupported flag, then we fall
+  // back to the original allocator.
+  if (uFlags & SHARED_ALLOC_UNSUPPORTED_FLAGS) {
+    return REAL(GlobalAlloc)(uFlags, dwBytes);
+  }
+
+  GET_STACK_TRACE_MALLOC;
+  if (uFlags & ZEROINIT)
+    return asan_calloc(dwBytes, 1, &stack);
+  else
+    return asan_malloc(dwBytes, &stack);
+}
+
+INTERCEPTOR_WINAPI(HGLOBAL, GlobalFree, HGLOBAL hMem) {
+  // If the memory we are trying to free is not owned
+  // by ASan heap, then fall back to the original GlobalFree.
+  if (OWNED_BY_RTL(GetProcessHeap(), hMem)) {
+    return REAL(GlobalFree)(hMem);
+  }
+  GET_STACK_TRACE_FREE;
+  asan_free(hMem, &stack, FROM_MALLOC);
+  return nullptr;
+}
+
+INTERCEPTOR_WINAPI(SIZE_T, GlobalSize, HGLOBAL hMem) {
+  // We need to check whether the ASAN allocator owns the pointer
+  // we're about to use. Allocations might occur before interception
+  // takes place, so if it is not owned by RTL heap, the we can
+  // pass it to ASAN heap for inspection.
+  if (!asan_inited || OWNED_BY_RTL(GetProcessHeap(), hMem))
+    return REAL(GlobalSize)(hMem);
+
+  GET_CURRENT_PC_BP_SP;
+  (void)sp;
+  return asan_malloc_usable_size(hMem, pc, bp);
+}
+
+namespace __asan {
+using GlobalLocalAlloc = HANDLE(WINAPI *)(UINT, SIZE_T);
+using GlobalLocalRealloc = HANDLE(WINAPI *)(HANDLE, SIZE_T, UINT);
+using GlobalLocalSize = SIZE_T(WINAPI *)(HANDLE);
+using GlobalLocalFree = HANDLE(WINAPI *)(HANDLE);
+using GlobalLocalLock = LPVOID(WINAPI *)(HANDLE);
+using GlobalLocalUnlock = LPVOID(WINAPI *)(HANDLE);
+
+enum class AllocationOwnership {
+  OWNED_BY_UNKNOWN,
+  OWNED_BY_ASAN,
+  OWNED_BY_RTL,
+  OWNED_BY_GLOBAL_OR_LOCAL,
+  OWNED_BY_GLOBAL_OR_LOCAL_HANDLE,
+};
+
+void *RtlToAsan(void *mPtr, size_t old_size, size_t dwBytes,
+                GlobalLocalFree freeFunc, BufferedStackTrace *stack) {
+  // Transfer from RTL owned allocation to ASAN owned allocation
+  void *replacement_alloc;
+  replacement_alloc = asan_calloc(dwBytes, 1, stack);
+  if (replacement_alloc) {
+    if (old_size == ((SIZE_T)0) - 1) {
+      asan_free(replacement_alloc, stack, FROM_MALLOC);
+      return nullptr;
+    }
+    REAL(memcpy)(replacement_alloc, mPtr, old_size);
+    freeFunc((HANDLE)mPtr);
+  }
+  return replacement_alloc;
+}
+
+void *AsanToRtl(void *mPtr, UINT uFlags, SIZE_T dwBytes,
+                GlobalLocalAlloc allocFunc, GlobalLocalLock lockFunc,
+                GlobalLocalLock unlockFunc, BufferedStackTrace *stack, uptr pc,
+                uptr bp) {
+  // Transfer from ASAN owned allocation to RTL owned allocation
+  void *replacement_alloc;
+  HANDLE mem = allocFunc(uFlags, dwBytes);
+  // GlobalLock/LocalLock return a pointer to the memory owned by the mem
+  // handle. We need the pointer to copy the data over from the ASAN owned
+  // memory.
+  replacement_alloc = (void *)lockFunc(mem);
+  size_t old_usable_size = 0;
+  if (replacement_alloc) {
+    old_usable_size = asan_malloc_usable_size(mPtr, pc, bp);
+    REAL(memcpy)
+    (replacement_alloc, mPtr, Min<size_t>(dwBytes, old_usable_size));
+    asan_free(mPtr, stack, FROM_MALLOC);
+  }
+  unlockFunc(mem);
+  return replacement_alloc;
+}
+
+void *ReAllocToAsan(UINT uFlags, void *mPtr, size_t dwBytes, uptr pc, uptr bp,
+                    BufferedStackTrace *stack) {
+  // GlobalAlloc, LocalAlloc, GlocalReAlloc and LocalReAlloc all
+  // accept 0 sized allocations. Passing a zero size into asan_realloc will
+  // free the allocation. To avoid this and keep behavior consistent, fudge
+  // the size if zero (asan_malloc already does this).
+  if (dwBytes == 0)
+    dwBytes = 1;
+
+  size_t old_size;
+  if (uFlags & ZEROINIT)
+    old_size = asan_malloc_usable_size(mPtr, pc, bp);
+
+  void *ptr = asan_realloc(mPtr, dwBytes, stack);
+  if (ptr == nullptr)
+    return nullptr;
+
+  if (uFlags & ZEROINIT) {
+    size_t new_size = asan_malloc_usable_size(ptr, pc, bp);
+    if (old_size < new_size)
+      REAL(memset)(((u8 *)ptr) + old_size, 0, new_size - old_size);
+  }
+  return ptr;
+}
+
+AllocationOwnership CheckGlobalLocalHeapOwnership(
+    HANDLE hMem, GlobalLocalLock lockFunc, GlobalLocalUnlock unlockFunc) {
+  /*  To figure the validity of hMem, we use GlobalLock/LocalLock. Those two
+   * functions can return three things: (1) the pointer that's passed in, in
+   * which case it is a pointer owned by the Global/Local heap (2) the pointer
+   * to the allocated object if it's a Global/Local heap HANDLE (3) nullptr if
+   * it's a pointer which does not belong to the Global/Local heap Using these
+   * three return types, we figure out if the pointer is TYPE_VALID_PTR or
+   * TYPE_HANDLE or TYPE_UNKNOWN_PTR
+   *
+   * NOTE: As an implementation detail, movable memory objects also live on the
+   * heap. HeapValidate will return true if given a moveable memory handle.
+   *
+   */
+
+  // Do this first to avoid expensive checks if the pointer is owned by ASAN.
+  if (__sanitizer_get_ownership(hMem)) {
+    return AllocationOwnership::OWNED_BY_ASAN;
+  }
+
+  // It is not safe to pass wild pointers to GlobalLock/LocalLock.
+  if (HeapValidate(GetProcessHeap(), 0, hMem)) {
+    void *ptr = lockFunc(hMem);
+    // We don't care whether ptr is moved after this point as we're just trying
+    // to determine where it came from.
+    unlockFunc(hMem);
+    if (ptr == hMem) {
+      return AllocationOwnership::OWNED_BY_GLOBAL_OR_LOCAL;
+    } else if (ptr != nullptr) {
+      return AllocationOwnership::OWNED_BY_GLOBAL_OR_LOCAL_HANDLE;
+    }
+  }
+  return AllocationOwnership::OWNED_BY_UNKNOWN;
+}
+
+void *ReAllocGlobalLocal(GlobalLocalRealloc reallocFunc,
+                         GlobalLocalSize sizeFunc, GlobalLocalFree freeFunc,
+                         GlobalLocalAlloc allocFunc, GlobalLocalLock lockFunc,
+                         GlobalLocalUnlock unlockFunc, HANDLE hMem,
+                         DWORD dwBytes, UINT uFlags) {
+  CHECK(reallocFunc && sizeFunc && freeFunc && allocFunc);
+  GET_STACK_TRACE_MALLOC;
+  GET_CURRENT_PC_BP_SP;
+  (void)sp;
+
+  bool only_asan_supported_flags =
+      (SHARED_ALLOC_UNSUPPORTED_FLAGS & uFlags) == 0;
+
+  AllocationOwnership ownershipState =
+      CheckGlobalLocalHeapOwnership(hMem, lockFunc, unlockFunc);
+
+  // If this global block which was allocated before the ASAN
+  // runtime came up OR if mPtr is invalid, use the real GlobalReAlloc function.
+  if (UNLIKELY(!asan_inited) ||
+      ownershipState == AllocationOwnership::OWNED_BY_GLOBAL_OR_LOCAL_HANDLE) {
+    return reallocFunc(hMem, dwBytes, uFlags);
+  }
+
+  // Since hMem is not a handle to moveable memory we may safely cast it to
+  // pointer.
+  void *mPtr = (void *)hMem;
+
+  if (ownershipState == AllocationOwnership::OWNED_BY_GLOBAL_OR_LOCAL ||
+      (ownershipState == AllocationOwnership::OWNED_BY_UNKNOWN &&
+       !only_asan_supported_flags)) {
+    if (only_asan_supported_flags) {
+      // if this is a conversion to ASAN supported flags, transfer this
+      // allocation to the ASAN allocator
+      return RtlToAsan(mPtr, sizeFunc(mPtr), dwBytes, freeFunc, &stack);
+    } else {
+      // owned by this heap or neither with unsupported ASAN flags,
+      // just pass back to original allocator
+      CHECK(ownershipState == AllocationOwnership::OWNED_BY_GLOBAL_OR_LOCAL ||
+            ownershipState == AllocationOwnership::OWNED_BY_UNKNOWN);
+      CHECK(!only_asan_supported_flags);
+      return reallocFunc(mPtr, dwBytes, uFlags);
+    }
+  }
+
+  if (ownershipState == AllocationOwnership::OWNED_BY_ASAN &&
+      !only_asan_supported_flags) {
+    // Conversion to unsupported flags allocation,
+    // transfer this allocation back to the original allocator.
+    return AsanToRtl(mPtr, uFlags, dwBytes, allocFunc, lockFunc, unlockFunc,
+                     &stack, pc, bp);
+  }
+
+  CHECK((ownershipState == AllocationOwnership::OWNED_BY_ASAN ||
+         ownershipState == AllocationOwnership::OWNED_BY_RTL ||
+         ownershipState == AllocationOwnership::OWNED_BY_UNKNOWN) &&
+        only_asan_supported_flags);
+
+  return ReAllocToAsan(uFlags, mPtr, dwBytes, pc, bp, &stack);
+}
+}  // namespace __asan
+
+INTERCEPTOR_WINAPI(HGLOBAL, GlobalReAlloc, HGLOBAL hMem, DWORD dwBytes,
+                   UINT uFlags) {
+  return ReAllocGlobalLocal(
+      (GlobalLocalRealloc)REAL(GlobalReAlloc),
+      (GlobalLocalSize)REAL(GlobalSize), (GlobalLocalFree)REAL(GlobalFree),
+      (GlobalLocalAlloc)REAL(GlobalAlloc), (GlobalLocalLock)GlobalLock,
+      (GlobalLocalUnlock)GlobalUnlock, (HANDLE)hMem, dwBytes, uFlags);
+}
+
+INTERCEPTOR_WINAPI(HLOCAL, LocalAlloc, UINT uFlags, SIZE_T uBytes) {
+  // If we encounter an unsupported flag, then we fall
+  // back to the original allocator.
+  if (uFlags & SHARED_ALLOC_UNSUPPORTED_FLAGS) {
+    return REAL(LocalAlloc)(uFlags, uBytes);
+  }
+
+  GET_STACK_TRACE_MALLOC;
+  if (uFlags & ZEROINIT)
+    return asan_calloc(uBytes, 1, &stack);
+  else
+    return asan_malloc(uBytes, &stack);
+}
+
+INTERCEPTOR_WINAPI(HLOCAL, LocalFree, HGLOBAL hMem) {
+  // If the memory we are trying to free is not owned
+  // ASan heap, then fall back to the original LocalFree.
+  if (OWNED_BY_RTL(GetProcessHeap(), hMem)) {
+    return REAL(LocalFree)(hMem);
+  }
+
+  GET_STACK_TRACE_FREE;
+  asan_free(hMem, &stack, FROM_MALLOC);
+  return nullptr;
+}
+
+INTERCEPTOR_WINAPI(SIZE_T, LocalSize, HGLOBAL hMem) {
+  // We need to check whether the ASAN allocator owns the pointer
+  // we're about to use. Allocations might occur before interception
+  // takes place, so if it is not owned by RTL heap, the we can
+  // pass it to ASAN heap for inspection.
+  if (!asan_inited || OWNED_BY_RTL(GetProcessHeap(), hMem))
+    return REAL(LocalSize)(hMem);
+
+  GET_CURRENT_PC_BP_SP;
+  (void)sp;
+  return asan_malloc_usable_size(hMem, pc, bp);
+}
+
+INTERCEPTOR_WINAPI(HLOCAL, LocalReAlloc, HGLOBAL hMem, DWORD dwBytes,
+                   UINT uFlags) {
+  return ReAllocGlobalLocal(
+      (GlobalLocalRealloc)REAL(LocalReAlloc), (GlobalLocalSize)REAL(LocalSize),
+      (GlobalLocalFree)REAL(LocalFree), (GlobalLocalAlloc)REAL(LocalAlloc),
+      (GlobalLocalLock)LocalLock, (GlobalLocalUnlock)LocalUnlock, (HANDLE)hMem,
+      dwBytes, uFlags);
+}
+
 namespace __asan {
 
 static void TryToOverrideFunction(const char *fname, uptr new_func) {
   // Failure here is not fatal. The CRT may not be present, and different CRT
   // versions use different symbols.
   if (!__interception::OverrideFunction(fname, new_func))
     VPrintf(2, "Failed to override function %s\n", fname);
 }
#if defined(ASAN_DYNAMIC)
   TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);
   TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);
   TryToOverrideFunction("_msize", (uptr)_msize);
   TryToOverrideFunction("_msize_base", (uptr)_msize);
   TryToOverrideFunction("_expand", (uptr)_expand);
   TryToOverrideFunction("_expand_base", (uptr)_expand);
 
   if (flags()->windows_hook_rtl_allocators) {
+    INTERCEPT_FUNCTION(GlobalAlloc);
+    INTERCEPT_FUNCTION(GlobalFree);
+    INTERCEPT_FUNCTION(GlobalSize);
+    INTERCEPT_FUNCTION(GlobalReAlloc);
+    INTERCEPT_FUNCTION(LocalAlloc);
+    INTERCEPT_FUNCTION(LocalFree);
+    INTERCEPT_FUNCTION(LocalSize);
+    INTERCEPT_FUNCTION(LocalReAlloc);
     INTERCEPT_FUNCTION(HeapSize);
     INTERCEPT_FUNCTION(HeapFree);
     INTERCEPT_FUNCTION(HeapReAlloc);
     INTERCEPT_FUNCTION(HeapAlloc);
 
     // Undocumented functions must be intercepted by name, not by symbol.
     __interception::OverrideFunction("RtlSizeHeap", (uptr)WRAP(RtlSizeHeap),
                                      (uptr *)&REAL(RtlSizeHeap));

compiler-rt/lib/interception/interception_win.cpp

 static uptr RoundUpTo(uptr size, uptr boundary) {
   return (size + boundary - 1) & ~(boundary - 1);
 }
 
 // FIXME: internal_str* and internal_mem* functions should be moved from the
 // ASan sources into interception/.
 
 static size_t _strlen(const char *str) {
-  const char* p = str;
+  const char *p = str;
   while (*p != '\0') ++p;
   return p - str;
 }
 
-static char* _strchr(char* str, char c) {
+static char *_strchr(char *str, char c) {
   while (*str) {
     if (*str == c)
       return str;
     ++str;
   }
   return nullptr;
 }
 
 static void _memset(void *p, int value, size_t sz) {
-  for (size_t i = 0; i < sz; ++i)
-    ((char*)p)[i] = (char)value;
+  for (size_t i = 0; i < sz; ++i) ((char *)p)[i] = (char)value;
 }
 
 static void _memcpy(void *dst, void *src, size_t sz) {
-  char *dst_c = (char*)dst,
-       *src_c = (char*)src;
-  for (size_t i = 0; i < sz; ++i)
-    dst_c[i] = src_c[i];
+  char *dst_c = (char *)dst, *src_c = (char *)src;
+  for (size_t i = 0; i < sz; ++i) dst_c[i] = src_c[i];
 }
 
-static bool ChangeMemoryProtection(
-    uptr address, uptr size, DWORD *old_protection) {
-  return ::VirtualProtect((void*)address, size,
-                          PAGE_EXECUTE_READWRITE,
+static bool ChangeMemoryProtection(uptr address, uptr size,
+                                   DWORD *old_protection) {
+  return ::VirtualProtect((void *)address, size, PAGE_EXECUTE_READWRITE,
                           old_protection) != FALSE;
 }
 
-static bool RestoreMemoryProtection(
-    uptr address, uptr size, DWORD old_protection) {
+static bool RestoreMemoryProtection(uptr address, uptr size,
+                                    DWORD old_protection) {
   DWORD unused;
-  return ::VirtualProtect((void*)address, size,
-                          old_protection,
-                          &unused) != FALSE;
+  return ::VirtualProtect((void *)address, size, old_protection, &unused) !=
+         FALSE;
 }
 
 static bool IsMemoryPadding(uptr address, uptr size) {
-  u8* function = (u8*)address;
+  u8 *function = (u8 *)address;
   for (size_t i = 0; i < size; ++i)
     if (function[i] != 0x90 && function[i] != 0xCC)
       return false;
   return true;
 }
 
-static const u8 kHintNop8Bytes[] = {
-  0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00
-};
+static const u8 kHintNop8Bytes[] = {0x0F, 0x1F, 0x84, 0x00,
+                                    0x00, 0x00, 0x00, 0x00};
 
-template<class T>
+template <class T>
 static bool FunctionHasPrefix(uptr address, const T &pattern) {
-  u8* function = (u8*)address - sizeof(pattern);
+  u8 *function = (u8 *)address - sizeof(pattern);
   for (size_t i = 0; i < sizeof(pattern); ++i)
     if (function[i] != pattern[i])
       return false;
   return true;
 }
 
 static bool FunctionHasPadding(uptr address, uptr size) {
   if (IsMemoryPadding(address - size, size))
     return true;
   if (size <= sizeof(kHintNop8Bytes) &&
       FunctionHasPrefix(address, kHintNop8Bytes))
     return true;
   return false;
 }
 
 static void WritePadding(uptr from, uptr size) {
-  _memset((void*)from, 0xCC, (size_t)size);
+  _memset((void *)from, 0xCC, (size_t)size);
 }
 
 static void WriteJumpInstruction(uptr from, uptr target) {
   if (!DistanceIsWithin2Gig(from + kJumpInstructionLength, target))
     InterceptionFailed();
   ptrdiff_t offset = target - from - kJumpInstructionLength;
-  *(u8*)from = 0xE9;
-  *(u32*)(from + 1) = offset;
+  *(u8 *)from = 0xE9;
+  *(u32 *)(from + 1) = offset;
 }
 
 static void WriteShortJumpInstruction(uptr from, uptr target) {
   sptr offset = target - from - kShortJumpInstructionLength;
   if (offset < -128 || offset > 127)
     InterceptionFailed();
-  *(u8*)from = 0xEB;
-  *(u8*)(from + 1) = (u8)offset;
+  *(u8 *)from = 0xEB;
+  *(u8 *)(from + 1) = (u8)offset;
 }
 
 #if SANITIZER_WINDOWS64
 static void WriteIndirectJumpInstruction(uptr from, uptr indirect_target) {
   // jmp [rip + <offset>] = FF 25 <offset> where <offset> is a relative
   // offset.
   // The offset is the distance from then end of the jump instruction to the
   // memory location containing the targeted address. The displacement is still
   // 32-bit in x64, so indirect_target must be located within +/- 2GB range.
   int offset = indirect_target - from - kIndirectJumpInstructionLength;
   if (!DistanceIsWithin2Gig(from + kIndirectJumpInstructionLength,
                             indirect_target)) {
     InterceptionFailed();
   }
-  *(u16*)from = 0x25FF;
-  *(u32*)(from + 2) = offset;
+  *(u16 *)from = 0x25FF;
+  *(u32 *)(from + 2) = offset;
 }
 #endif
 
-static void WriteBranch(
-    uptr from, uptr indirect_target, uptr target) {
+static void WriteBranch(uptr from, uptr indirect_target, uptr target) {
 #if SANITIZER_WINDOWS64
   WriteIndirectJumpInstruction(from, indirect_target);
-  *(u64*)indirect_target = target;
+  *(u64 *)indirect_target = target;
 #else
   (void)indirect_target;
   WriteJumpInstruction(from, target);
 #endif
 }
 
 static void WriteDirectBranch(uptr from, uptr target) {
 #if SANITIZER_WINDOWS64

 static TrampolineMemoryRegion TrampolineRegions[kMaxTrampolineRegion];
 
 static void *AllocateTrampolineRegion(uptr image_address, size_t granularity) {
 #if SANITIZER_WINDOWS64
   uptr address = image_address;
   uptr scanned = 0;
   while (scanned < kTrampolineScanLimitRange) {
     MEMORY_BASIC_INFORMATION info;
-    if (!::VirtualQuery((void*)address, &info, sizeof(info)))
+    if (!::VirtualQuery((void *)address, &info, sizeof(info)))
       return nullptr;
 
     // Check whether a region can be allocated at |address|.
     if (info.State == MEM_FREE && info.RegionSize >= granularity) {
-      void *page = ::VirtualAlloc((void*)RoundUpTo(address, granularity),
-                                  granularity,
-                                  MEM_RESERVE | MEM_COMMIT,
-                                  PAGE_EXECUTE_READWRITE);
+      void *page =
+          ::VirtualAlloc((void *)RoundUpTo(address, granularity), granularity,
+                         MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
       return page;
     }
 
     // Move to the next region.
     address = (uptr)info.BaseAddress + info.RegionSize;
     scanned += info.RegionSize;
   }
   return nullptr;
 #else
-  return ::VirtualAlloc(nullptr,
-                        granularity,
-                        MEM_RESERVE | MEM_COMMIT,
+  return ::VirtualAlloc(nullptr, granularity, MEM_RESERVE | MEM_COMMIT,
                         PAGE_EXECUTE_READWRITE);
 #endif
 }
 
 // Used by unittests to release mapped memory space.
 void TestOnlyReleaseTrampolineRegions() {
   for (size_t bucket = 0; bucket < kMaxTrampolineRegion; ++bucket) {
     TrampolineMemoryRegion *current = &TrampolineRegions[bucket];
     if (current->content == 0)
       return;
-    ::VirtualFree((void*)current->content, 0, MEM_RELEASE);
+    ::VirtualFree((void *)current->content, 0, MEM_RELEASE);
     current->content = 0;
   }
 }
 
 static uptr AllocateMemoryForTrampoline(uptr image_address, size_t size) {
   // Find a region within 2G with enough space to allocate |size| bytes.
   TrampolineMemoryRegion *region = nullptr;
   for (size_t bucket = 0; bucket < kMaxTrampolineRegion; ++bucket) {
-    TrampolineMemoryRegion* current = &TrampolineRegions[bucket];
+    TrampolineMemoryRegion *current = &TrampolineRegions[bucket];
     if (current->content == 0) {
       // No valid region found, allocate a new region.
       size_t bucket_size = GetMmapGranularity();
       void *content = AllocateTrampolineRegion(image_address, bucket_size);
       if (content == nullptr)
         return 0U;
 
       current->content = (uptr)content;
#endif
   uptr allocated_space = region->content + region->allocated_size;
   region->allocated_size += size;
   WritePadding(allocated_space, size);
 
   return allocated_space;
 }
 
 // Returns 0 on error.
-static size_t GetInstructionSize(uptr address, size_t* rel_offset = nullptr) {
-  switch (*(u64*)address) {
+static size_t GetInstructionSize(uptr address, size_t *rel_offset = nullptr) {
+  switch (*(u64 *)address) {
     case 0x90909090909006EB:  // stub: jmp over 6 x nop.
       return 8;
   }
 
-  switch (*(u8*)address) {
+  switch (*(u8 *)address) {
     case 0x90:  // 90 : nop
       return 1;
 
     case 0x50:  // push eax / rax
     case 0x51:  // push ecx / rcx
     case 0x52:  // push edx / rdx
     case 0x53:  // push ebx / rbx
     case 0x54:  // push esp / rsp
switch (*(u8 *)address) {
     case 0x7B:
     case 0x7C:
     case 0x7D:
     case 0x7E:
     case 0x7F:
       return 0;
   }
 
-  switch (*(u16*)(address)) {
+  switch (*(u16 *)(address)) {
     case 0x018A:  // 8A 01 : mov al, byte ptr [ecx]
     case 0xFF8B:  // 8B FF : mov edi, edi
     case 0xEC8B:  // 8B EC : mov ebp, esp
     case 0xc889:  // 89 C8 : mov eax, ecx
     case 0xC18B:  // 8B C1 : mov eax, ecx
     case 0xC033:  // 33 C0 : xor eax, eax
     case 0xC933:  // 33 C9 : xor ecx, ecx
     case 0xD233:  // 33 D2 : xor edx, edx
       return 2;
 
     // Cannot overwrite control-instruction. Return 0 to indicate failure.
     case 0x25FF:  // FF 25 XX XX XX XX : jmp [XXXXXXXX]
       return 0;
   }
 
-  switch (0x00FFFFFF & *(u32*)address) {
+  switch (0x00FFFFFF & *(u32 *)address) {
     case 0x24A48D:  // 8D A4 24 XX XX XX XX : lea esp, [esp + XX XX XX XX]
       return 7;
   }
 
 #if SANITIZER_WINDOWS64
-  switch (*(u8*)address) {
+  switch (*(u8 *)address) {
     case 0xA1:  // A1 XX XX XX XX XX XX XX XX :
                 //   movabs eax, dword ptr ds:[XXXXXXXX]
       return 9;
   }
 
-  switch (*(u16*)address) {
+  switch (*(u16 *)address) {
     case 0x5040:  // push rax
     case 0x5140:  // push rcx
     case 0x5240:  // push rdx
     case 0x5340:  // push rbx
     case 0x5440:  // push rsp
     case 0x5540:  // push rbp
     case 0x5640:  // push rsi
     case 0x5740:  // push rdi
     case 0x5441:  // push r12
     case 0x5541:  // push r13
     case 0x5641:  // push r14
     case 0x5741:  // push r15
     case 0x9066:  // Two-byte NOP
       return 2;
 
     case 0x058B:  // 8B 05 XX XX XX XX : mov eax, dword ptr [XX XX XX XX]
       if (rel_offset)
         *rel_offset = 2;
       return 6;
   }
 
-  switch (0x00FFFFFF & *(u32*)address) {
+  switch (0x00FFFFFF & *(u32 *)address) {
     case 0xe58948:  // 48 8b c4 : mov rbp, rsp
     case 0xc18b48:  // 48 8b c1 : mov rax, rcx
     case 0xc48b48:  // 48 8b c4 : mov rax, rsp
     case 0xd9f748:  // 48 f7 d9 : neg rcx
     case 0xd12b48:  // 48 2b d1 : sub rdx, rcx
     case 0x07c1f6:  // f6 c1 07 : test cl, 0x7
     case 0xc98548:  // 48 85 C9 : test rcx, rcx
     case 0xc0854d:  // 4d 85 c0 : test r8, r8
switch (0x00FFFFFF & *(u32 *)address) {
     case 0xdc8b4c:  // 4c 8b dc : mov r11, rsp
     case 0xd18b4c:  // 4c 8b d1 : mov r10, rcx
     case 0xE0E483:  // 83 E4 E0 : and esp, 0xFFFFFFE0
       return 3;
 
     case 0xec8348:  // 48 83 ec XX : sub rsp, XX
     case 0xf88349:  // 49 83 f8 XX : cmp r8, XX
     case 0x588948:  // 48 89 58 XX : mov QWORD PTR[rax + XX], rbx
+    case 0x245489:  // 89 54 24 XX : mov DWORD PTR[rsp + XX], edx
       return 4;
 
     case 0xec8148:  // 48 81 EC XX XX XX XX : sub rsp, XXXXXXXX
       return 7;
 
     case 0x058b48:  // 48 8b 05 XX XX XX XX :
                     //   mov rax, QWORD PTR [rip + XXXXXXXX]
     case 0x25ff48:  // 48 ff 25 XX XX XX XX :
                     //   rex.W jmp QWORD PTR [rip + XXXXXXXX]
 
       // Instructions having offset relative to 'rip' need offset adjustment.
       if (rel_offset)
         *rel_offset = 3;
       return 7;
 
     case 0x2444c7:  // C7 44 24 XX YY YY YY YY
                     //   mov dword ptr [rsp + XX], YYYYYYYY
       return 8;
   }
 
-  switch (*(u32*)(address)) {
+  switch (*(u32 *)(address)) {
     case 0x24448b48:  // 48 8b 44 24 XX : mov rax, QWORD ptr [rsp + XX]
     case 0x246c8948:  // 48 89 6C 24 XX : mov QWORD ptr [rsp + XX], rbp
     case 0x245c8948:  // 48 89 5c 24 XX : mov QWORD PTR [rsp + XX], rbx
     case 0x24748948:  // 48 89 74 24 XX : mov QWORD PTR [rsp + XX], rsi
     case 0x244C8948:  // 48 89 4C 24 XX : mov QWORD PTR [rsp + XX], rcx
     case 0x24548948:  // 48 89 54 24 XX : mov QWORD PTR [rsp + XX], rdx
     case 0x244c894c:  // 4c 89 4c 24 XX : mov QWORD PTR [rsp + XX], r9
     case 0x2444894c:  // 4c 89 44 24 XX : mov QWORD PTR [rsp + XX], r8
       return 5;
     case 0x24648348:  // 48 83 64 24 XX : and QWORD PTR [rsp + XX], YY
       return 6;
   }
 
 #else
 
-  switch (*(u8*)address) {
+  switch (*(u8 *)address) {
     case 0xA1:  // A1 XX XX XX XX :  mov eax, dword ptr ds:[XXXXXXXX]
       return 5;
   }
-  switch (*(u16*)address) {
+  switch (*(u16 *)address) {
     case 0x458B:  // 8B 45 XX : mov eax, dword ptr [ebp + XX]
     case 0x5D8B:  // 8B 5D XX : mov ebx, dword ptr [ebp + XX]
     case 0x7D8B:  // 8B 7D XX : mov edi, dword ptr [ebp + XX]
     case 0xEC83:  // 83 EC XX : sub esp, XX
     case 0x75FF:  // FF 75 XX : push dword ptr [ebp + XX]
       return 3;
     case 0xC1F7:  // F7 C1 XX YY ZZ WW : test ecx, WWZZYYXX
     case 0x25FF:  // FF 25 XX YY ZZ WW : jmp dword ptr ds:[WWZZYYXX]
       return 6;
     case 0x3D83:  // 83 3D XX YY ZZ WW TT : cmp TT, WWZZYYXX
       return 7;
     case 0x7D83:  // 83 7D XX YY : cmp dword ptr [ebp + XX], YY
       return 4;
   }
 
-  switch (0x00FFFFFF & *(u32*)address) {
+  switch (0x00FFFFFF & *(u32 *)address) {
     case 0x24448A:  // 8A 44 24 XX : mov eal, dword ptr [esp + XX]
     case 0x24448B:  // 8B 44 24 XX : mov eax, dword ptr [esp + XX]
     case 0x244C8B:  // 8B 4C 24 XX : mov ecx, dword ptr [esp + XX]
     case 0x24548B:  // 8B 54 24 XX : mov edx, dword ptr [esp + XX]
     case 0x24748B:  // 8B 74 24 XX : mov esi, dword ptr [esp + XX]
     case 0x247C8B:  // 8B 7C 24 XX : mov edi, dword ptr [esp + XX]
       return 4;
   }
 
-  switch (*(u32*)address) {
+  switch (*(u32 *)address) {
     case 0x2444B60F:  // 0F B6 44 24 XX : movzx eax, byte ptr [esp + XX]
       return 5;
   }
 #endif
 
   // Unknown instruction!
   // FIXME: Unknown instruction failures might happen when we add a new
   // interceptor or a new compiler version. In either case, they should result
static size_t RoundUpToInstrBoundary(size_t size, uptr address) {
   return cursor;
 }
 
 static bool CopyInstructions(uptr to, uptr from, size_t size) {
   size_t cursor = 0;
   while (cursor != size) {
     size_t rel_offset = 0;
     size_t instruction_size = GetInstructionSize(from + cursor, &rel_offset);
-    _memcpy((void*)(to + cursor), (void*)(from + cursor),
+    _memcpy((void *)(to + cursor), (void *)(from + cursor),
             (size_t)instruction_size);
     if (rel_offset) {
       uptr delta = to - from;
-      uptr relocated_offset = *(u32*)(to + cursor + rel_offset) - delta;
+      uptr relocated_offset = *(u32 *)(to + cursor + rel_offset) - delta;
 #if SANITIZER_WINDOWS64
       if (relocated_offset + 0x80000000U >= 0xFFFFFFFFU)
         return false;
 #endif
-      *(u32*)(to + cursor + rel_offset) = relocated_offset;
+      *(u32 *)(to + cursor + rel_offset) = relocated_offset;
     }
     cursor += instruction_size;
   }
   return true;
 }
 
-
 #if !SANITIZER_WINDOWS64
-bool OverrideFunctionWithDetour(
-    uptr old_func, uptr new_func, uptr *orig_old_func) {
+bool OverrideFunctionWithDetour(uptr old_func, uptr new_func,
+                                uptr *orig_old_func) {
   const int kDetourHeaderLen = 5;
   const u16 kDetourInstruction = 0xFF8B;
 
   uptr header = (uptr)old_func - kDetourHeaderLen;
   uptr patch_length = kDetourHeaderLen + kShortJumpInstructionLength;
 
   // Validate that the function is hookable.
-  if (*(u16*)old_func != kDetourInstruction ||
+  if (*(u16 *)old_func != kDetourInstruction ||
       !IsMemoryPadding(header, kDetourHeaderLen))
     return false;
 
   // Change memory protection to writable.
   DWORD protection = 0;
   if (!ChangeMemoryProtection(header, patch_length, &protection))
     return false;
 
bool OverrideFunctionWithDetour(uptr old_func, uptr new_func,
 
   if (orig_old_func)
     *orig_old_func = old_func + kShortJumpInstructionLength;
 
   return true;
 }
 #endif
 
-bool OverrideFunctionWithRedirectJump(
-    uptr old_func, uptr new_func, uptr *orig_old_func) {
+bool OverrideFunctionWithRedirectJump(uptr old_func, uptr new_func,
+                                      uptr *orig_old_func) {
   // Check whether the first instruction is a relative jump.
-  if (*(u8*)old_func != 0xE9)
+  if (*(u8 *)old_func != 0xE9)
     return false;
 
   if (orig_old_func) {
-    uptr relative_offset = *(u32*)(old_func + 1);
+    uptr relative_offset = *(u32 *)(old_func + 1);
     uptr absolute_target = old_func + relative_offset + kJumpInstructionLength;
     *orig_old_func = absolute_target;
   }
 
 #if SANITIZER_WINDOWS64
   // If needed, get memory space for a trampoline jump.
   uptr trampoline = AllocateMemoryForTrampoline(old_func, kDirectBranchLength);
   if (!trampoline)
#endif
 
   // Restore previous memory protection.
   if (!RestoreMemoryProtection(old_func, kJumpInstructionLength, protection))
     return false;
 
   return true;
 }
 
-bool OverrideFunctionWithHotPatch(
-    uptr old_func, uptr new_func, uptr *orig_old_func) {
+bool OverrideFunctionWithHotPatch(uptr old_func, uptr new_func,
+                                  uptr *orig_old_func) {
   const int kHotPatchHeaderLen = kBranchLength;
 
   uptr header = (uptr)old_func - kHotPatchHeaderLen;
   uptr patch_length = kHotPatchHeaderLen + kShortJumpInstructionLength;
 
   // Validate that the function is hot patchable.
   size_t instruction_size = GetInstructionSize(old_func);
   if (instruction_size < kShortJumpInstructionLength ||
#endif
 
   // Restore previous memory protection.
   if (!RestoreMemoryProtection(header, patch_length, protection))
     return false;
 
   return true;
 }
 
-bool OverrideFunctionWithTrampoline(
-    uptr old_func, uptr new_func, uptr *orig_old_func) {
-
+bool OverrideFunctionWithTrampoline(uptr old_func, uptr new_func,
+                                    uptr *orig_old_func) {
   size_t instructions_length = kBranchLength;
   size_t padding_length = 0;
   uptr indirect_address = 0;
 
   if (orig_old_func) {
     // Find out the number of bytes of the instructions we need to copy
     // to the trampoline.
     instructions_length = RoundUpToInstrBoundary(kBranchLength, old_func);
#endif
 
   // Restore previous memory protection.
   if (!RestoreMemoryProtection(patch_address, patch_length, protection))
     return false;
 
   return true;
 }
 
-bool OverrideFunction(
-    uptr old_func, uptr new_func, uptr *orig_old_func) {
+bool OverrideFunction(uptr old_func, uptr new_func, uptr *orig_old_func) {
 #if !SANITIZER_WINDOWS64
   if (OverrideFunctionWithDetour(old_func, new_func, orig_old_func))
     return true;
 #endif
   if (OverrideFunctionWithRedirectJump(old_func, new_func, orig_old_func))
     return true;
   if (OverrideFunctionWithHotPatch(old_func, new_func, orig_old_func))
     return true;
   if (OverrideFunctionWithTrampoline(old_func, new_func, orig_old_func))
     return true;
   return false;
 }
 
 static void **InterestingDLLsAvailable() {
   static const char *InterestingDLLs[] = {
       "kernel32.dll",
       "msvcr100.dll",      // VS2010
       "msvcr110.dll",      // VS2012
       "msvcr120.dll",      // VS2013
       "vcruntime140.dll",  // VS2015
       "ucrtbase.dll",      // Universal CRT
+      "KERNELBASE.dll",  // KernelBase for GlobalAlloc and LocalAlloc (dynamic)
       // NTDLL should go last as it exports some functions that we should
       // override in the CRT [presumably only used internally].
       "ntdll.dll", NULL};
-  static void *result[ARRAY_SIZE(InterestingDLLs)] = { 0 };
+  static void *result[ARRAY_SIZE(InterestingDLLs)] = {0};
   if (!result[0]) {
     for (size_t i = 0, j = 0; InterestingDLLs[i]; ++i) {
       if (HMODULE h = GetModuleHandleA(InterestingDLLs[i]))
         result[j++] = (void *)h;
     }
   }
   return &result[0];
 }
 
 namespace {
 // Utility for reading loaded PE images.
-template <typename T> class RVAPtr {
+template <typename T>
+class RVAPtr {
  public:
   RVAPtr(void *module, uptr rva)
       : ptr_(reinterpret_cast<T *>(reinterpret_cast<char *>(module) + rva)) {}
   operator T *() { return ptr_; }
   T *operator->() { return ptr_; }
   T *operator++() { return ++ptr_; }
 
  private:
if (!strcmp(func_name, name)) {
         // exported directory.
         char function_name[256];
         size_t funtion_name_length = _strlen(func);
         if (funtion_name_length >= sizeof(function_name) - 1)
           InterceptionFailed();
 
         _memcpy(function_name, func, funtion_name_length);
         function_name[funtion_name_length] = '\0';
-        char* separator = _strchr(function_name, '.');
+        char *separator = _strchr(function_name, '.');
         if (!separator)
           InterceptionFailed();
         *separator = '\0';
 
-        void* redirected_module = GetModuleHandleA(function_name);
+        void *redirected_module = GetModuleHandleA(function_name);
         if (!redirected_module)
           InterceptionFailed();
         return InternalGetProcAddress(redirected_module, separator + 1);
       }
 
       return (uptr)(char *)func;
     }
   }
 
   return 0;
 }
 
-bool OverrideFunction(
-    const char *func_name, uptr new_func, uptr *orig_old_func) {
+bool OverrideFunction(const char *func_name, uptr new_func,
+                      uptr *orig_old_func) {
   bool hooked = false;
   void **DLLs = InterestingDLLsAvailable();
   for (size_t i = 0; DLLs[i]; ++i) {
     uptr func_addr = InternalGetProcAddress(DLLs[i], func_name);
-    if (func_addr &&
-        OverrideFunction(func_addr, new_func, orig_old_func)) {
+    if (func_addr && OverrideFunction(func_addr, new_func, orig_old_func)) {
       hooked = true;
     }
   }
   return hooked;
 }
 
 bool OverrideImportedFunction(const char *module_to_patch,
                               const char *imported_module,

compiler-rt/test/asan/TestCases/Windows/dll_host.cpp

 // RUN:  > %t.imports1
 //
 // Add functions interecepted in asan_malloc.win.cpp and asan_win.cpp.
 // RUN: grep '[I]MPORT:' %s | sed -e 's/.*[I]MPORT: //' > %t.imports2
 // IMPORT: __asan_wrap_HeapAlloc
 // IMPORT: __asan_wrap_HeapFree
 // IMPORT: __asan_wrap_HeapReAlloc
 // IMPORT: __asan_wrap_HeapSize
+// IMPORT: __asan_wrap_GlobalAlloc
+// IMPORT: __asan_wrap_GlobalFree
+// IMPORT: __asan_wrap_GlobalReAlloc
+// IMPORT: __asan_wrap_GlobalSize
+// IMPORT: __asan_wrap_LocalAlloc
+// IMPORT: __asan_wrap_LocalFree
+// IMPORT: __asan_wrap_LocalReAlloc
+// IMPORT: __asan_wrap_LocalSize
 // IMPORT: __asan_wrap_CreateThread
 // IMPORT: __asan_wrap_RaiseException
 // IMPORT: __asan_wrap_RtlRaiseException
 // IMPORT: __asan_wrap_SetUnhandledExceptionFilter
 // IMPORT: __asan_wrap_RtlSizeHeap
 // IMPORT: __asan_wrap_RtlAllocateHeap
 // IMPORT: __asan_wrap_RtlReAllocateHeap
 // IMPORT: __asan_wrap_RtlFreeHeap

compiler-rt/test/asan/TestCases/Windows/globalalloc.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true not %run %t 2>&1 | FileCheck %s
+
+#include <windows.h>
+
+int main() {
+  char *buffer;
+  buffer = (char *)GlobalAlloc(GMEM_FIXED, 32),
+  buffer[33] = 'a';
+  // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
+  // CHECK: WRITE of size 1 at [[ADDR]] thread T0
+}

compiler-rt/test/asan/TestCases/Windows/globalalloc_doublefree.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true not %run %t 2>&1 | FileCheck %s
+
+#include <cassert>
+#include <windows.h>
+
+int main() {
+  void *allocation = GlobalAlloc(GMEM_FIXED, 10);
+  assert(allocation != 0);
+  assert(GlobalFree(allocation) == NULL);
+  GlobalFree(allocation); //will dump
+  assert(0 && "GlobalFree double free should produce an ASAN dump\n");
+  return 0;
+}
+
+// CHECK: AddressSanitizer: attempting double-free on [[addr:0x[0-9a-fA-F]+]] in thread T0:
 No newline at end of file

compiler-rt/test/asan/TestCases/Windows/globalalloc_flags_fallback.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %run %t 2>&1 | FileCheck %s
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1 | FileCheck %s
+// UNSUPPORTED: asan-64-bits
+#include <assert.h>
+#include <stdio.h>
+#include <windows.h>
+
+extern "C" int
+__sanitizer_get_ownership(const volatile void *p);
+
+int main() {
+  char *buffer;
+  HGLOBAL hMem;
+  hMem = GlobalAlloc(GMEM_MOVEABLE, 32);
+  buffer = (char *)GlobalLock(hMem);
+  buffer[0] = 'a';
+  assert(!__sanitizer_get_ownership(buffer));
+  GlobalUnlock(hMem);
+  GlobalFree(buffer);
+  puts("Okay");
+  // CHECK: Okay
+}

compiler-rt/test/asan/TestCases/Windows/globalalloc_huge.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=allocator_may_return_null=true %run %t
+// RUN: %env_asan_opts=allocator_may_return_null=true:windows_hook_rtl_allocators=true %run %t
+// UNSUPPORTED: asan-64-bits
+#include <stdio.h>
+#include <windows.h>
+int main() {
+  void *nope = GlobalAlloc(GMEM_FIXED, ((size_t)0) - 1);
+  if (nope != nullptr) {
+    puts("Fail");
+    return 1;
+  }
+  puts("Pass");
+  return 0;
+}
+// CHECK: Pass
+// CHECK-NOT: Fail
 No newline at end of file

compiler-rt/test/asan/TestCases/Windows/globalalloc_sanity.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1 | FileCheck %s
+#include <stdio.h>
+#include <windows.h>
+
+int main() {
+  char *buffer;
+  buffer = (char *)GlobalAlloc(GMEM_FIXED, 32),
+  buffer[0] = 'a';
+  GlobalFree(buffer);
+  puts("Okay");
+  // CHECK: Okay
+}

compiler-rt/test/asan/TestCases/Windows/globalalloc_transfer.cpp

+#include "sanitizer\allocator_interface.h"
+#include <cassert>
+#include <stdio.h>
+#include <windows.h>
+// RUN: %clang_cl_asan %s -o%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1 | FileCheck %s
+// UNSUPPORTED: asan-64-bits
+
+int main() {
+  void *buffer, *realloc;
+  HGLOBAL hMem1, hMem2, hMem3;
+
+  //owned by rtl
+  hMem1 = GlobalAlloc(GMEM_MOVEABLE, 100);
+  buffer = (void *)GlobalLock(hMem1);
+  assert(buffer);
+
+  // still owned by rtl
+  hMem2 = GlobalReAlloc(buffer, 100, GMEM_MOVEABLE);
+  GlobalUnlock(hMem1);
+  buffer = (void *)GlobalLock(hMem2);
+  assert(buffer);
+  assert(!__sanitizer_get_ownership(buffer));
+  assert(HeapValidate(GetProcessHeap(), 0, buffer));
+
+  //convert to asan owned
+  realloc = GlobalReAlloc(buffer, 500, GMEM_FIXED);
+  GlobalUnlock(hMem2);
+  buffer = nullptr;
+  assert(realloc);
+  assert(__sanitizer_get_ownership(realloc));
+
+  //convert back to rtl owned;
+  hMem3 = GlobalReAlloc(realloc, 100, GMEM_MOVEABLE);
+  buffer = (void *)GlobalLock(hMem3);
+  assert(buffer);
+  assert(!__sanitizer_get_ownership(buffer));
+  assert(HeapValidate(GetProcessHeap(), 0, buffer));
+
+  GlobalUnlock(hMem3);
+  printf("Success\n");
+}
+
+// CHECK-NOT: assert
+// CHECK-NOT: AddressSanitizer
+// CHECK: Success

compiler-rt/test/asan/TestCases/Windows/globalalloc_uaf.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true not %run %t 2>&1 | FileCheck %s
+
+#include <windows.h>
+
+int main() {
+  char *buffer;
+  buffer = (char *)GlobalAlloc(GMEM_FIXED, 32),
+  GlobalFree(buffer);
+  buffer[0] = 'a';
+  // CHECK: AddressSanitizer: heap-use-after-free on address [[ADDR:0x[0-9a-f]+]]
+  // CHECK: WRITE of size 1 at [[ADDR]] thread T0
+}

compiler-rt/test/asan/TestCases/Windows/globalalloc_zero_size.cpp

+// RUN: %clang_cl_asan /Od -o %t %s
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1 | FileCheck %s
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=false %run %t 2>&1 | FileCheck %s
+// RUN: %clang_cl /Od -o %t %s
+// RUN: %run %t 2>&1 | FileCheck %s
+// UNSUPPORTED: asan-64-bits
+#include <cassert>
+#include <stdio.h>
+#include <windows.h>
+#include <winbase.h>
+
+int main() {
+  void *ptr = GlobalAlloc(GMEM_FIXED, 4);
+  assert(ptr);
+  void *ptr2 = GlobalReAlloc(ptr, 0, GMEM_ZEROINIT);
+  assert(ptr2);
+  GlobalFree(ptr2);
+  fprintf(stderr, "passed!\n");
+}
+
+// CHECK-NOT: double-free
+// CHECK-NOT: AddressSanitizer
+// CHECK: passed!
 No newline at end of file

compiler-rt/test/asan/TestCases/Windows/globalrealloc.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true not %run %t 2>&1 | FileCheck %s
+// UNSUPPORTED: asan-64-bits
+#include <stdio.h>
+#include <windows.h>
+#include <winbase.h>
+
+int main() {
+  char *oldbuf;
+  size_t sz = 8;
+  oldbuf = (char *)GlobalAlloc(GMEM_FIXED, sz);
+  char *newbuf = oldbuf;
+  while (oldbuf == newbuf) {
+    sz *= 2;
+    newbuf = (char *)GlobalReAlloc(oldbuf, sz, GMEM_ZEROINIT);
+  }
+
+  newbuf[0] = 'a';
+  oldbuf[0] = 'a';
+  // CHECK: AddressSanitizer: heap-use-after-free on address [[ADDR:0x[0-9a-f]+]]
+  // CHECK: WRITE of size 1 at [[WRITE2:0x[0-9a-f]+]] thread T0
+  // CHECK: #0 {{0x[0-9a-f]+ in main.*}}:[[@LINE-3]]
+}

compiler-rt/test/asan/TestCases/Windows/heapalloc_freenull.cc

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1
+// UNSUPPORTED: asan-64-bits
+#include <cassert>
+#include <windows.h>
+
+int main() {
+  void *allocation = HeapAlloc(GetProcessHeap(), 0, 10);
+  assert(allocation != 0);
+  HeapFree(GetProcessHeap(), 0, (void *)0);
+  //TODO: This should actually trigger a report, since Free(NULL) is undefined for windows.
+  return 0;
+}

compiler-rt/test/asan/TestCases/Windows/heapalloc_huge.cpp

 // RUN: %clang_cl_asan -Od %s -Fe%t
 // RUN: %env_asan_opts=allocator_may_return_null=true %run %t
 // RUN: %env_asan_opts=allocator_may_return_null=true:windows_hook_rtl_allocators=true %run %t
 // UNSUPPORTED: asan-64-bits
+#include <stdio.h>
 #include <windows.h>
 int main() {
   void *nope = HeapAlloc(GetProcessHeap(), 0, ((size_t)0) - 1);
   return (nope == nullptr) ? 0 : 1;
 }

compiler-rt/test/asan/TestCases/Windows/localalloc.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true not %run %t 2>&1 | FileCheck %s
+
+#include <windows.h>
+
+int main() {
+  char *buffer;
+  buffer = (char *)LocalAlloc(LMEM_FIXED, 32),
+  buffer[33] = 'a';
+  // CHECK: AddressSanitizer: heap-buffer-overflow on address [[ADDR:0x[0-9a-f]+]]
+  // CHECK: WRITE of size 1 at [[ADDR]] thread T0
+}

compiler-rt/test/asan/TestCases/Windows/localalloc_doublefree.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true not %run %t 2>&1 | FileCheck %s
+
+#include <cassert>
+#include <windows.h>
+
+int main() {
+  void *allocation = LocalAlloc(LMEM_FIXED, 10);
+  assert(allocation != 0);
+  assert(LocalFree(allocation) == NULL);
+  LocalFree(allocation); //will dump
+  assert(0 && "LocalFree double free should produce an ASAN dump\n");
+  return 0;
+}
+
+// CHECK: AddressSanitizer: attempting double-free on [[addr:0x[0-9a-fA-F]+]] in thread T0:
 No newline at end of file

compiler-rt/test/asan/TestCases/Windows/localalloc_flags_fallback.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %run %t 2>&1 | FileCheck %s
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1 | FileCheck %s
+// UNSUPPORTED: asan-64-bits
+#include <assert.h>
+#include <stdio.h>
+#include <windows.h>
+
+extern "C" int
+__sanitizer_get_ownership(const volatile void *p);
+
+int main() {
+  char *buffer;
+  HGLOBAL hMem;
+  hMem = LocalAlloc(LMEM_MOVEABLE, 32);
+  buffer = (char *)LocalLock(hMem);
+  buffer[0] = 'a';
+  assert(!__sanitizer_get_ownership(buffer));
+  LocalUnlock(hMem);
+  LocalFree(buffer);
+  puts("Okay");
+  // CHECK: Okay
+}
 No newline at end of file

compiler-rt/test/asan/TestCases/Windows/localalloc_huge.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=allocator_may_return_null=true %run %t
+// RUN: %env_asan_opts=allocator_may_return_null=true:windows_hook_rtl_allocators=true %run %t
+// UNSUPPORTED: asan-64-bits
+#include <windows.h>
+int main() {
+  void *nope = LocalAlloc(LMEM_FIXED, ((size_t)0) - 1);
+  return nope != nullptr;
+}
 No newline at end of file

compiler-rt/test/asan/TestCases/Windows/localalloc_sanity.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1 | FileCheck %s
+#include <stdio.h>
+#include <windows.h>
+
+int main() {
+  char *buffer;
+  buffer = (char *)LocalAlloc(LMEM_FIXED, 32),
+  buffer[0] = 'a';
+  LocalFree(buffer);
+  puts("Okay");
+  // CHECK: Okay
+}

compiler-rt/test/asan/TestCases/Windows/localalloc_uaf.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true not %run %t 2>&1 | FileCheck %s
+
+#include <windows.h>
+
+int main() {
+  char *buffer;
+  buffer = (char *)LocalAlloc(LMEM_FIXED, 32),
+  LocalFree(buffer);
+  buffer[0] = 'a';
+  // CHECK: AddressSanitizer: heap-use-after-free on address [[ADDR:0x[0-9a-f]+]]
+  // CHECK: WRITE of size 1 at [[ADDR]] thread T0
+}

compiler-rt/test/asan/TestCases/Windows/localalloc_zero_size.cpp

+// RUN: %clang_cl_asan /Od -o %t %s
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1 | FileCheck %s
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=false %run %t 2>&1 | FileCheck %s
+// RUN: %clang_cl /Od -o %t %s
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1 | FileCheck %s
+// UNSUPPORTED: asan-64-bits
+#include <windows.h>
+#include <cassert>
+#include <stdio.h>
+#include <winbase.h>
+
+int main() {
+  void *ptr = LocalAlloc(LMEM_FIXED, 4);
+  assert(ptr);
+  void *ptr2 = LocalReAlloc(ptr, 0, LMEM_ZEROINIT);
+  assert(ptr2);
+  LocalFree(ptr2);
+  fprintf(stderr, "passed!\n");
+}
+
+// CHECK-NOT: double-free
+// CHECK-NOT: AddressSanitizer
+// CHECK: passed!
 No newline at end of file

compiler-rt/test/asan/TestCases/Windows/localrealloc.cpp

+// RUN: %clang_cl_asan /Od %s -Fe%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true not %run %t 2>&1 | FileCheck %s
+// UNSUPPORTED: asan-64-bits
+#include <stdio.h>
+#include <windows.h>
+#include <winbase.h>
+
+int main() {
+  char *oldbuf;
+  size_t sz = 8;
+  oldbuf = (char *)LocalAlloc(LMEM_FIXED, sz);
+  char *newbuf = oldbuf;
+  while (oldbuf == newbuf) {
+    sz *= 2;
+    newbuf = (char *)LocalReAlloc(oldbuf, sz, LMEM_ZEROINIT);
+  }
+
+  newbuf[0] = 'a';
+  oldbuf[0] = 'a';
+  // CHECK: AddressSanitizer: heap-use-after-free on address [[ADDR:0x[0-9a-f]+]]
+  // CHECK: WRITE of size 1 at [[WRITE2:0x[0-9a-f]+]] thread T0
+  // CHECK: #0 {{0x[0-9a-f]+ in main.*}}:[[@LINE-3]]
+}
 No newline at end of file

compiler-rt/test/asan/TestCases/Windows/localrealloc_transfer.cpp

+#include "sanitizer\allocator_interface.h"
+#include <cassert>
+#include <stdio.h>
+#include <windows.h>
+// RUN: %clang_cl_asan %s -o%t
+// RUN: %env_asan_opts=windows_hook_rtl_allocators=true %run %t 2>&1 | FileCheck %s
+// UNSUPPORTED: asan-64-bits
+
+int main() {
+  void *buffer, *realloc;
+  HLOCAL hMem1, hMem2, hMem3;
+
+  //owned by rtl
+  hMem1 = LocalAlloc(LMEM_MOVEABLE, 100);
+  buffer = (void *)LocalLock(hMem1);
+  assert(buffer);
+
+  // still owned by rtl
+  hMem2 = LocalReAlloc(buffer, 100, LMEM_MOVEABLE);
+  LocalUnlock(hMem1);
+  buffer = (void *)LocalLock(hMem2);
+  assert(buffer);
+  assert(!__sanitizer_get_ownership(buffer));
+  assert(HeapValidate(GetProcessHeap(), 0, buffer));
+
+  //convert to asan owned
+  realloc = LocalReAlloc(buffer, 500, LMEM_FIXED);
+  LocalUnlock(hMem2);
+  buffer = nullptr;
+  assert(realloc);
+  assert(__sanitizer_get_ownership(realloc));
+
+  //convert back to rtl owned;
+  hMem3 = LocalReAlloc(realloc, 100, LMEM_MOVEABLE);
+  buffer = (void *)LocalLock(hMem3);
+  assert(buffer);
+  assert(!__sanitizer_get_ownership(buffer));
+  assert(HeapValidate(GetProcessHeap(), 0, buffer));
+
+  LocalUnlock(hMem3);
+  printf("Success\n");
+}
+
+// CHECK-NOT: assert
+// CHECK-NOT: AddressSanitizer
+// CHECK: Success