1 files changed, 47 insertions, 7 deletions

diff --git a/src/common/memarea.c b/src/common/memarea.c
index ac26c5fd90..6893639a6e 100644
--- a/src/common/memarea.c
+++ b/src/common/memarea.c
@@ -11,7 +11,11 @@
 #include "memarea.h"
 #include "util.h"
 #include "compat.h"
-#include "log.h"
+#include "torlog.h"
+
+/** If true, we try to detect any attempts to write beyond the length of a
+ * memarea. */
+#define USE_SENTINELS
 
 /** All returned pointers should be aligned to the nearest multiple of this
  * value. */
@@ -25,6 +29,30 @@
 #error "void* is neither 4 nor 8 bytes long. I don't know how to align stuff."
 #endif
 
+#ifdef USE_SENTINELS
+/** Magic value that we stick at the end of a memarea so we can make sure
+ * there are no run-off-the-end bugs. */
+#define SENTINEL_VAL 0x90806622u
+/** How many bytes per area do we devote to the sentinel? */
+#define SENTINEL_LEN sizeof(uint32_t)
+/** Given a mem_area_chunk_t with SENTINEL_LEN extra bytes allocated at the
+ * end, set those bytes. */
+#define SET_SENTINEL(chunk)                                     \
+  STMT_BEGIN                                                    \
+  set_uint32( &(chunk)->u.mem[chunk->mem_size], SENTINEL_VAL ); \
+  STMT_END
+/** Assert that the sentinel on a memarea is set correctly. */
+#define CHECK_SENTINEL(chunk)                                           \
+  STMT_BEGIN                                                            \
+  uint32_t sent_val = get_uint32(&(chunk)->u.mem[chunk->mem_size]);     \
+  tor_assert(sent_val == SENTINEL_VAL);                                 \
+  STMT_END
+#else
+#define SENTINEL_LEN 0
+#define SET_SENTINEL(chunk) STMT_NIL
+#define CHECK_SENTINEL(chunk) STMT_NIL
+#endif
+
 /** Increment <b>ptr</b> until it is aligned to MEMAREA_ALIGN. */
 static INLINE void *
 realign_pointer(void *ptr)
@@ -51,8 +79,11 @@ typedef struct memarea_chunk_t {
   } u;
 } memarea_chunk_t;
 
+/** How many bytes are needed for overhead before we get to the memory part
+ * of a chunk? */
 #define CHUNK_HEADER_SIZE STRUCT_OFFSET(memarea_chunk_t, u)
 
+/** What's the smallest that we'll allocate a chunk? */
 #define CHUNK_SIZE 4096
 
 /** A memarea_t is an allocation region for a set of small memory requests
@@ -79,15 +110,20 @@ alloc_chunk(size_t sz, int freelist_ok)
     freelist = res->next_chunk;
     res->next_chunk = NULL;
     --freelist_len;
+    CHECK_SENTINEL(res);
     return res;
   } else {
     size_t chunk_size = freelist_ok ? CHUNK_SIZE : sz;
-    memarea_chunk_t *res = tor_malloc_roundup(&chunk_size);
+    memarea_chunk_t *res;
+    chunk_size += SENTINEL_LEN;
+    res = tor_malloc_roundup(&chunk_size);
     res->next_chunk = NULL;
-    res->mem_size = chunk_size - CHUNK_HEADER_SIZE;
+    res->mem_size = chunk_size - CHUNK_HEADER_SIZE - SENTINEL_LEN;
     res->next_mem = res->u.mem;
-    tor_assert(res->next_mem+res->mem_size == ((char*)res)+chunk_size);
+    tor_assert(res->next_mem+res->mem_size+SENTINEL_LEN ==
+               ((char*)res)+chunk_size);
     tor_assert(realign_pointer(res->next_mem) == res->next_mem);
+    SET_SENTINEL(res);
     return res;
   }
 }
@@ -95,8 +131,9 @@ alloc_chunk(size_t sz, int freelist_ok)
 /** Release <b>chunk</b> from a memarea, either by adding it to the freelist
  * or by freeing it if the freelist is already too big. */
 static void
-chunk_free(memarea_chunk_t *chunk)
+chunk_free_unchecked(memarea_chunk_t *chunk)
 {
+  CHECK_SENTINEL(chunk);
   if (freelist_len < MAX_FREELIST_LEN) {
     ++freelist_len;
     chunk->next_chunk = freelist;
@@ -124,7 +161,7 @@ memarea_drop_all(memarea_t *area)
   memarea_chunk_t *chunk, *next;
   for (chunk = area->first; chunk; chunk = next) {
     next = chunk->next_chunk;
-    chunk_free(chunk);
+    chunk_free_unchecked(chunk);
   }
   area->first = NULL; /*fail fast on */
   tor_free(area);
@@ -140,7 +177,7 @@ memarea_clear(memarea_t *area)
   if (area->first->next_chunk) {
     for (chunk = area->first->next_chunk; chunk; chunk = next) {
       next = chunk->next_chunk;
-      chunk_free(chunk);
+      chunk_free_unchecked(chunk);
     }
     area->first->next_chunk = NULL;
   }
@@ -183,6 +220,7 @@ memarea_alloc(memarea_t *area, size_t sz)
   memarea_chunk_t *chunk = area->first;
   char *result;
   tor_assert(chunk);
+  CHECK_SENTINEL(chunk);
   tor_assert(sz < SIZE_T_CEILING);
   if (sz == 0)
     sz = 1;
@@ -261,6 +299,7 @@ memarea_get_stats(memarea_t *area, size_t *allocated_out, size_t *used_out)
   size_t a = 0, u = 0;
   memarea_chunk_t *chunk;
   for (chunk = area->first; chunk; chunk = chunk->next_chunk) {
+    CHECK_SENTINEL(chunk);
     a += CHUNK_HEADER_SIZE + chunk->mem_size;
     tor_assert(chunk->next_mem >= chunk->u.mem);
     u += CHUNK_HEADER_SIZE + (chunk->next_mem - chunk->u.mem);
@@ -277,6 +316,7 @@ memarea_assert_ok(memarea_t *area)
   tor_assert(area->first);
 
   for (chunk = area->first; chunk; chunk = chunk->next_chunk) {
+    CHECK_SENTINEL(chunk);
     tor_assert(chunk->next_mem >= chunk->u.mem);
     tor_assert(chunk->next_mem <=
           (char*) realign_pointer(chunk->u.mem+chunk->mem_size));