From 16ae09484226f66e1a837992dfeb6bc65d75b784 Mon Sep 17 00:00:00 2001 From: Ching-Hsin Lee Date: Sat, 2 Sep 2023 11:46:35 +0800 Subject: [PATCH 1/2] Update block validate macro in heap_5 * Not validate block pointer when configENABLE_HEAP_PROTECTOR is not set to 1 --- portable/MemMang/heap_5.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/portable/MemMang/heap_5.c b/portable/MemMang/heap_5.c index 17b0d07d91..3e6457981c 100644 --- a/portable/MemMang/heap_5.c +++ b/portable/MemMang/heap_5.c @@ -143,30 +143,32 @@ typedef struct A_BLOCK_LINK /* Canary value for protecting internal heap pointers. */ PRIVILEGED_DATA static portPOINTER_SIZE_TYPE xHeapCanary; - /* Macro to load/store BlockLink_t pointers to memory. By XORing the * pointers with a random canary value, heap overflows will result * in randomly unpredictable pointer values which will be caught by * heapVALIDATE_BLOCK_POINTER assert. */ #define heapPROTECT_BLOCK_POINTER( pxBlock ) ( ( BlockLink_t * ) ( ( ( portPOINTER_SIZE_TYPE ) ( pxBlock ) ) ^ xHeapCanary ) ) -#else /* if ( configENABLE_HEAP_PROTECTOR == 1 ) */ - - #define heapPROTECT_BLOCK_POINTER( pxBlock ) ( pxBlock ) - -#endif /* configENABLE_HEAP_PROTECTOR */ - -/* Highest and lowest heap addresses used for heap block bounds checking. */ -PRIVILEGED_DATA static uint8_t * pucHeapHighAddress = NULL; -PRIVILEGED_DATA static uint8_t * pucHeapLowAddress = NULL; - /* Assert that a heap block pointer is within the heap bounds. */ -#define heapVALIDATE_BLOCK_POINTER( pxBlock ) \ + #define heapVALIDATE_BLOCK_POINTER( pxBlock ) \ configASSERT( ( pucHeapHighAddress != NULL ) && \ ( pucHeapLowAddress != NULL ) && \ ( ( uint8_t * ) ( pxBlock ) >= pucHeapLowAddress ) && \ ( ( uint8_t * ) ( pxBlock ) < pucHeapHighAddress ) ) +/* Highest and lowest heap addresses used for heap block bounds checking. */ + PRIVILEGED_DATA static uint8_t * pucHeapHighAddress = NULL; + PRIVILEGED_DATA static uint8_t * pucHeapLowAddress = NULL; + +#else /* if ( configENABLE_HEAP_PROTECTOR == 1 ) */ + + #define heapPROTECT_BLOCK_POINTER( pxBlock ) ( pxBlock ) + + #define heapVALIDATE_BLOCK_POINTER( pxBlock ) ( pxBlock ) + +#endif /* configENABLE_HEAP_PROTECTOR */ + + /*-----------------------------------------------------------*/ /* From 60c39e12fcbac7a71a41a896312ee6b4228dbaaa Mon Sep 17 00:00:00 2001 From: Ching-Hsin Lee Date: Sat, 2 Sep 2023 14:09:29 +0800 Subject: [PATCH 2/2] Update for readibility --- portable/MemMang/heap_5.c | 55 ++++++++++++++++++++++----------------- 1 file changed, 31 insertions(+), 24 deletions(-) diff --git a/portable/MemMang/heap_5.c b/portable/MemMang/heap_5.c index 3e6457981c..a801298c1c 100644 --- a/portable/MemMang/heap_5.c +++ b/portable/MemMang/heap_5.c @@ -117,32 +117,12 @@ #define heapALLOCATE_BLOCK( pxBlock ) ( ( pxBlock->xBlockSize ) |= heapBLOCK_ALLOCATED_BITMASK ) #define heapFREE_BLOCK( pxBlock ) ( ( pxBlock->xBlockSize ) &= ~heapBLOCK_ALLOCATED_BITMASK ) -/*-----------------------------------------------------------*/ - -/* Define the linked list structure. This is used to link free blocks in order - * of their memory address. */ -typedef struct A_BLOCK_LINK -{ - struct A_BLOCK_LINK * pxNextFreeBlock; /**< The next free block in the list. */ - size_t xBlockSize; /**< The size of the free block. */ -} BlockLink_t; - /* Setting configENABLE_HEAP_PROTECTOR to 1 enables heap block pointers * protection using an application supplied canary value to catch heap * corruption should a heap buffer overflow occur. */ #if ( configENABLE_HEAP_PROTECTOR == 1 ) -/** - * @brief Application provided function to get a random value to be used as canary. - * - * @param pxHeapCanary [out] Output parameter to return the canary value. - */ - extern void vApplicationGetRandomHeapCanary( portPOINTER_SIZE_TYPE * pxHeapCanary ); - -/* Canary value for protecting internal heap pointers. */ - PRIVILEGED_DATA static portPOINTER_SIZE_TYPE xHeapCanary; - /* Macro to load/store BlockLink_t pointers to memory. By XORing the * pointers with a random canary value, heap overflows will result * in randomly unpredictable pointer values which will be caught by @@ -156,10 +136,6 @@ typedef struct A_BLOCK_LINK ( ( uint8_t * ) ( pxBlock ) >= pucHeapLowAddress ) && \ ( ( uint8_t * ) ( pxBlock ) < pucHeapHighAddress ) ) -/* Highest and lowest heap addresses used for heap block bounds checking. */ - PRIVILEGED_DATA static uint8_t * pucHeapHighAddress = NULL; - PRIVILEGED_DATA static uint8_t * pucHeapLowAddress = NULL; - #else /* if ( configENABLE_HEAP_PROTECTOR == 1 ) */ #define heapPROTECT_BLOCK_POINTER( pxBlock ) ( pxBlock ) @@ -168,6 +144,15 @@ typedef struct A_BLOCK_LINK #endif /* configENABLE_HEAP_PROTECTOR */ +/*-----------------------------------------------------------*/ + +/* Define the linked list structure. This is used to link free blocks in order + * of their memory address. */ +typedef struct A_BLOCK_LINK +{ + struct A_BLOCK_LINK * pxNextFreeBlock; /**< The next free block in the list. */ + size_t xBlockSize; /**< The size of the free block. */ +} BlockLink_t; /*-----------------------------------------------------------*/ @@ -179,6 +164,17 @@ typedef struct A_BLOCK_LINK */ static void prvInsertBlockIntoFreeList( BlockLink_t * pxBlockToInsert ) PRIVILEGED_FUNCTION; void vPortDefineHeapRegions( const HeapRegion_t * const pxHeapRegions ) PRIVILEGED_FUNCTION; + +#if ( configENABLE_HEAP_PROTECTOR == 1 ) + +/** + * @brief Application provided function to get a random value to be used as canary. + * + * @param pxHeapCanary [out] Output parameter to return the canary value. + */ + extern void vApplicationGetRandomHeapCanary( portPOINTER_SIZE_TYPE * pxHeapCanary ); +#endif /* configENABLE_HEAP_PROTECTOR */ + /*-----------------------------------------------------------*/ /* The size of the structure placed at the beginning of each allocated memory @@ -196,6 +192,17 @@ PRIVILEGED_DATA static size_t xMinimumEverFreeBytesRemaining = 0U; PRIVILEGED_DATA static size_t xNumberOfSuccessfulAllocations = 0; PRIVILEGED_DATA static size_t xNumberOfSuccessfulFrees = 0; +#if ( configENABLE_HEAP_PROTECTOR == 1 ) + +/* Canary value for protecting internal heap pointers. */ + PRIVILEGED_DATA static portPOINTER_SIZE_TYPE xHeapCanary; + +/* Highest and lowest heap addresses used for heap block bounds checking. */ + PRIVILEGED_DATA static uint8_t * pucHeapHighAddress = NULL; + PRIVILEGED_DATA static uint8_t * pucHeapLowAddress = NULL; + +#endif /* configENABLE_HEAP_PROTECTOR */ + /*-----------------------------------------------------------*/ void * pvPortMalloc( size_t xWantedSize )