1: /*
2: +----------------------------------------------------------------------+
3: | Suhosin-Patch for PHP |
4: +----------------------------------------------------------------------+
5: | Copyright (c) 2004-2011 Stefan Esser |
6: +----------------------------------------------------------------------+
7: | This source file is subject to version 2.02 of the PHP license, |
8: | that is bundled with this package in the file LICENSE, and is |
9: | available at through the world-wide-web at |
10: | http://www.php.net/license/2_02.txt. |
11: | If you did not receive a copy of the PHP license and are unable to |
12: | obtain it through the world-wide-web, please send a note to |
13: | license@php.net so we can mail you a copy immediately. |
14: +----------------------------------------------------------------------+
15: | Author: Stefan Esser <stefan.esser@sektioneins.de> |
16: +----------------------------------------------------------------------+
17: */
18: /* $Id: zend_alloc_canary.c,v 1.1.1.1 2012/02/21 23:47:52 misho Exp $ */
19:
20: #include "zend.h"
21: #include "zend_alloc.h"
22: #include "zend_globals.h"
23: #include "zend_operators.h"
24:
25: #ifdef HAVE_SIGNAL_H
26: # include <signal.h>
27: #endif
28: #ifdef HAVE_UNISTD_H
29: # include <unistd.h>
30: #endif
31:
32: #if SUHOSIN_PATCH
33: #include "suhosin_patch.h"
34: #endif
35:
36: #ifdef ZEND_WIN32
37: # include <wincrypt.h>
38: # include <process.h>
39: #endif
40:
41: #ifndef ZEND_MM_HEAP_PROTECTION
42: # define ZEND_MM_HEAP_PROTECTION ZEND_DEBUG
43: #endif
44:
45: #ifndef ZEND_MM_SAFE_UNLINKING
46: # define ZEND_MM_SAFE_UNLINKING 1
47: #endif
48:
49: #ifndef ZEND_MM_COOKIES
50: # define ZEND_MM_COOKIES ZEND_DEBUG
51: #endif
52:
53: #ifdef _WIN64
54: # define PTR_FMT "0x%0.16I64x"
55: /*
56: #elif sizeof(long) == 8
57: # define PTR_FMT "0x%0.16lx"
58: */
59: #else
60: # define PTR_FMT "0x%0.8lx"
61: #endif
62:
63: #define SUHOSIN_MM_WITH_CANARY_PROTECTION 1
64:
65: #if (defined (__GNUC__) && __GNUC__ > 2 ) && !defined(__INTEL_COMPILER) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX)
66: static void zend_mm_panic(const char *message) __attribute__ ((noreturn));
67: #endif
68:
69: static void zend_mm_panic(const char *message)
70: {
71: fprintf(stderr, "%s\n", message);
72: /* See http://support.microsoft.com/kb/190351 */
73: #ifdef PHP_WIN32
74: fflush(stderr);
75: #endif
76: #if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
77: kill(getpid(), SIGSEGV);
78: #endif
79: exit(1);
80: }
81:
82: /*******************/
83: /* Storage Manager */
84: /*******************/
85:
86: #ifdef ZEND_WIN32
87: # define HAVE_MEM_WIN32 /* use VirtualAlloc() to allocate memory */
88: #endif
89: #define HAVE_MEM_MALLOC /* use malloc() to allocate segments */
90:
91: #include <sys/types.h>
92: #include <sys/stat.h>
93: #if HAVE_LIMITS_H
94: #include <limits.h>
95: #endif
96: #include <fcntl.h>
97: #include <errno.h>
98:
99: #if defined(HAVE_MEM_MMAP_ANON) || defined(HAVE_MEM_MMAP_ZERO)
100: # ifdef HAVE_MREMAP
101: # ifndef _GNU_SOURCE
102: # define _GNU_SOURCE
103: # endif
104: # ifndef __USE_GNU
105: # define __USE_GNU
106: # endif
107: # endif
108: # include <sys/mman.h>
109: # ifndef MAP_ANON
110: # ifdef MAP_ANONYMOUS
111: # define MAP_ANON MAP_ANONYMOUS
112: # endif
113: # endif
114: # ifndef MREMAP_MAYMOVE
115: # define MREMAP_MAYMOVE 0
116: # endif
117: # ifndef MAP_FAILED
118: # define MAP_FAILED ((void*)-1)
119: # endif
120: #endif
121:
122: static zend_intptr_t SUHOSIN_POINTER_GUARD = 0;
123:
124: static zend_mm_storage* zend_mm_mem_dummy_init(void *params)
125: {
126: return malloc(sizeof(zend_mm_storage));
127: }
128:
129: static void zend_mm_mem_dummy_dtor(zend_mm_storage *storage)
130: {
131: free(storage);
132: }
133:
134: static void zend_mm_mem_dummy_compact(zend_mm_storage *storage)
135: {
136: }
137:
138: #if defined(HAVE_MEM_MMAP_ANON) || defined(HAVE_MEM_MMAP_ZERO)
139:
140: static zend_mm_segment* zend_mm_mem_mmap_realloc(zend_mm_storage *storage, zend_mm_segment* segment, size_t size)
141: {
142: zend_mm_segment *ret;
143: #ifdef HAVE_MREMAP
144: #if defined(__NetBSD__)
145: /* NetBSD 5 supports mremap but takes an extra newp argument */
146: ret = (zend_mm_segment*)mremap(segment, segment->size, segment, size, MREMAP_MAYMOVE);
147: #else
148: ret = (zend_mm_segment*)mremap(segment, segment->size, size, MREMAP_MAYMOVE);
149: #endif
150: if (ret == MAP_FAILED) {
151: #endif
152: ret = storage->handlers->_alloc(storage, size);
153: if (ret) {
154: memcpy(ret, segment, size > segment->size ? segment->size : size);
155: storage->handlers->_free(storage, segment);
156: }
157: #ifdef HAVE_MREMAP
158: }
159: #endif
160: return ret;
161: }
162:
163: static void zend_mm_mem_mmap_free(zend_mm_storage *storage, zend_mm_segment* segment)
164: {
165: munmap((void*)segment, segment->size);
166: }
167:
168: #endif
169:
170: #ifdef HAVE_MEM_MMAP_ANON
171:
172: static zend_mm_segment* zend_mm_mem_mmap_anon_alloc(zend_mm_storage *storage, size_t size)
173: {
174: zend_mm_segment *ret = (zend_mm_segment*)mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
175: if (ret == MAP_FAILED) {
176: ret = NULL;
177: }
178: return ret;
179: }
180:
181: # define ZEND_MM_MEM_MMAP_ANON_DSC {"mmap_anon", zend_mm_mem_dummy_init, zend_mm_mem_dummy_dtor, zend_mm_mem_dummy_compact, zend_mm_mem_mmap_anon_alloc, zend_mm_mem_mmap_realloc, zend_mm_mem_mmap_free}
182:
183: #endif
184:
185: #ifdef HAVE_MEM_MMAP_ZERO
186:
187: static int zend_mm_dev_zero_fd = -1;
188:
189: static zend_mm_storage* zend_mm_mem_mmap_zero_init(void *params)
190: {
191: if (zend_mm_dev_zero_fd != -1) {
192: zend_mm_dev_zero_fd = open("/dev/zero", O_RDWR, S_IRUSR | S_IWUSR);
193: }
194: if (zend_mm_dev_zero_fd >= 0) {
195: return malloc(sizeof(zend_mm_storage));
196: } else {
197: return NULL;
198: }
199: }
200:
201: static void zend_mm_mem_mmap_zero_dtor(zend_mm_storage *storage)
202: {
203: close(zend_mm_dev_zero_fd);
204: free(storage);
205: }
206:
207: static zend_mm_segment* zend_mm_mem_mmap_zero_alloc(zend_mm_storage *storage, size_t size)
208: {
209: zend_mm_segment *ret = (zend_mm_segment*)mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, zend_mm_dev_zero_fd, 0);
210: if (ret == MAP_FAILED) {
211: ret = NULL;
212: }
213: return ret;
214: }
215:
216: # define ZEND_MM_MEM_MMAP_ZERO_DSC {"mmap_zero", zend_mm_mem_mmap_zero_init, zend_mm_mem_mmap_zero_dtor, zend_mm_mem_dummy_compact, zend_mm_mem_mmap_zero_alloc, zend_mm_mem_mmap_realloc, zend_mm_mem_mmap_free}
217:
218: #endif
219:
220: #ifdef HAVE_MEM_WIN32
221:
222: static zend_mm_storage* zend_mm_mem_win32_init(void *params)
223: {
224: HANDLE heap = HeapCreate(HEAP_NO_SERIALIZE, 0, 0);
225: zend_mm_storage* storage;
226:
227: if (heap == NULL) {
228: return NULL;
229: }
230: storage = (zend_mm_storage*)malloc(sizeof(zend_mm_storage));
231: if (storage == NULL) {
232: HeapDestroy(heap);
233: return NULL;
234: }
235: storage->data = (void*) heap;
236: return storage;
237: }
238:
239: static void zend_mm_mem_win32_dtor(zend_mm_storage *storage)
240: {
241: HeapDestroy((HANDLE)storage->data);
242: free(storage);
243: }
244:
245: static void zend_mm_mem_win32_compact(zend_mm_storage *storage)
246: {
247: HeapDestroy((HANDLE)storage->data);
248: storage->data = (void*)HeapCreate(HEAP_NO_SERIALIZE, 0, 0);
249: }
250:
251: static zend_mm_segment* zend_mm_mem_win32_alloc(zend_mm_storage *storage, size_t size)
252: {
253: return (zend_mm_segment*) HeapAlloc((HANDLE)storage->data, HEAP_NO_SERIALIZE, size);
254: }
255:
256: static void zend_mm_mem_win32_free(zend_mm_storage *storage, zend_mm_segment* segment)
257: {
258: HeapFree((HANDLE)storage->data, HEAP_NO_SERIALIZE, segment);
259: }
260:
261: static zend_mm_segment* zend_mm_mem_win32_realloc(zend_mm_storage *storage, zend_mm_segment* segment, size_t size)
262: {
263: return (zend_mm_segment*) HeapReAlloc((HANDLE)storage->data, HEAP_NO_SERIALIZE, segment, size);
264: }
265:
266: # define ZEND_MM_MEM_WIN32_DSC {"win32", zend_mm_mem_win32_init, zend_mm_mem_win32_dtor, zend_mm_mem_win32_compact, zend_mm_mem_win32_alloc, zend_mm_mem_win32_realloc, zend_mm_mem_win32_free}
267:
268: #endif
269:
270: #ifdef HAVE_MEM_MALLOC
271:
272: static zend_mm_segment* zend_mm_mem_malloc_alloc(zend_mm_storage *storage, size_t size)
273: {
274: return (zend_mm_segment*)malloc(size);
275: }
276:
277: static zend_mm_segment* zend_mm_mem_malloc_realloc(zend_mm_storage *storage, zend_mm_segment *ptr, size_t size)
278: {
279: return (zend_mm_segment*)realloc(ptr, size);
280: }
281:
282: static void zend_mm_mem_malloc_free(zend_mm_storage *storage, zend_mm_segment *ptr)
283: {
284: free(ptr);
285: }
286:
287: # define ZEND_MM_MEM_MALLOC_DSC {"malloc", zend_mm_mem_dummy_init, zend_mm_mem_dummy_dtor, zend_mm_mem_dummy_compact, zend_mm_mem_malloc_alloc, zend_mm_mem_malloc_realloc, zend_mm_mem_malloc_free}
288:
289: #endif
290:
291: static const zend_mm_mem_handlers mem_handlers[] = {
292: #ifdef HAVE_MEM_WIN32
293: ZEND_MM_MEM_WIN32_DSC,
294: #endif
295: #ifdef HAVE_MEM_MALLOC
296: ZEND_MM_MEM_MALLOC_DSC,
297: #endif
298: #ifdef HAVE_MEM_MMAP_ANON
299: ZEND_MM_MEM_MMAP_ANON_DSC,
300: #endif
301: #ifdef HAVE_MEM_MMAP_ZERO
302: ZEND_MM_MEM_MMAP_ZERO_DSC,
303: #endif
304: {NULL, NULL, NULL, NULL, NULL, NULL}
305: };
306:
307: # define ZEND_MM_STORAGE_DTOR() heap->storage->handlers->dtor(heap->storage)
308: # define ZEND_MM_STORAGE_ALLOC(size) heap->storage->handlers->_alloc(heap->storage, size)
309: # define ZEND_MM_STORAGE_REALLOC(ptr, size) heap->storage->handlers->_realloc(heap->storage, ptr, size)
310: # define ZEND_MM_STORAGE_FREE(ptr) heap->storage->handlers->_free(heap->storage, ptr)
311:
312: /****************/
313: /* Heap Manager */
314: /****************/
315:
316: #define MEM_BLOCK_VALID 0x7312F8DC
317: #define MEM_BLOCK_FREED 0x99954317
318: #define MEM_BLOCK_CACHED 0xFB8277DC
319: #define MEM_BLOCK_GUARD 0x2A8FCC84
320: #define MEM_BLOCK_LEAK 0x6C5E8F2D
321:
322: #if SUHOSIN_MM_WITH_CANARY_PROTECTION
323: # define CANARY_SIZE sizeof(size_t)
324: #else
325: # define CANARY_SIZE 0
326: #endif
327:
328: /* mm block type */
329: typedef struct _zend_mm_block_info_canary {
330: #if ZEND_MM_COOKIES
331: size_t _cookie;
332: #endif
333: #if SUHOSIN_MM_WITH_CANARY_PROTECTION
334: size_t canary_1;
335: #endif
336: size_t _size;
337: size_t _prev;
338: #if SUHOSIN_PATCH
339: size_t size;
340: #if SUHOSIN_MM_WITH_CANARY_PROTECTION
341: size_t canary_2;
342: #endif
343: #endif
344: } zend_mm_block_info_canary;
345:
346: #if ZEND_DEBUG
347:
348: typedef struct _zend_mm_debug_info_canary {
349: char *filename;
350: uint lineno;
351: char *orig_filename;
352: uint orig_lineno;
353: size_t size;
354: #if ZEND_MM_HEAP_PROTECTION
355: unsigned int start_magic;
356: #endif
357: } zend_mm_debug_info_canary;
358:
359: #elif ZEND_MM_HEAP_PROTECTION
360:
361: typedef struct _zend_mm_debug_info_canary {
362: size_t size;
363: unsigned int start_magic;
364: } zend_mm_debug_info_canary;
365:
366: #endif
367:
368: typedef struct _zend_mm_block_canary {
369: zend_mm_block_info_canary info;
370: #if ZEND_DEBUG
371: unsigned int magic;
372: # ifdef ZTS
373: THREAD_T thread_id;
374: # endif
375: zend_mm_debug_info_canary debug;
376: #elif ZEND_MM_HEAP_PROTECTION
377: zend_mm_debug_info_canary debug;
378: #endif
379: } zend_mm_block_canary;
380:
381: typedef struct _zend_mm_small_free_block_canary {
382: zend_mm_block_info_canary info;
383: #if ZEND_DEBUG
384: unsigned int magic;
385: # ifdef ZTS
386: THREAD_T thread_id;
387: # endif
388: #endif
389: struct _zend_mm_free_block_canary *prev_free_block;
390: struct _zend_mm_free_block_canary *next_free_block;
391: } zend_mm_small_free_block_canary;
392:
393: typedef struct _zend_mm_free_block_canary {
394: zend_mm_block_info_canary info;
395: #if ZEND_DEBUG
396: unsigned int magic;
397: # ifdef ZTS
398: THREAD_T thread_id;
399: # endif
400: #endif
401: struct _zend_mm_free_block_canary *prev_free_block;
402: struct _zend_mm_free_block_canary *next_free_block;
403:
404: struct _zend_mm_free_block_canary **parent;
405: struct _zend_mm_free_block_canary *child[2];
406: } zend_mm_free_block_canary;
407:
408: #define ZEND_MM_NUM_BUCKETS (sizeof(size_t) << 3)
409:
410: #define ZEND_MM_CACHE 1
411: #define ZEND_MM_CACHE_SIZE (ZEND_MM_NUM_BUCKETS * 4 * 1024)
412:
413: #ifndef ZEND_MM_CACHE_STAT
414: # define ZEND_MM_CACHE_STAT 0
415: #endif
416:
417: typedef struct _zend_mm_heap_canary {
418: int use_zend_alloc;
419: void *(*_malloc)(size_t);
420: void (*_free)(void*);
421: void *(*_realloc)(void*, size_t);
422: size_t free_bitmap;
423: size_t large_free_bitmap;
424: size_t block_size;
425: size_t compact_size;
426: zend_mm_segment *segments_list;
427: zend_mm_storage *storage;
428: size_t real_size;
429: size_t real_peak;
430: size_t limit;
431: size_t size;
432: size_t peak;
433: size_t reserve_size;
434: void *reserve;
435: int overflow;
436: int internal;
437: #if ZEND_MM_CACHE
438: unsigned int cached;
439: zend_mm_free_block_canary *cache[ZEND_MM_NUM_BUCKETS];
440: #endif
441: zend_mm_free_block_canary *free_buckets[ZEND_MM_NUM_BUCKETS*2];
442: zend_mm_free_block_canary *large_free_buckets[ZEND_MM_NUM_BUCKETS];
443: zend_mm_free_block_canary *rest_buckets[2];
444: #if ZEND_MM_CACHE_STAT
445: struct {
446: int count;
447: int max_count;
448: int hit;
449: int miss;
450: } cache_stat[ZEND_MM_NUM_BUCKETS+1];
451: #endif
452: #if SUHOSIN_PATCH
453: size_t canary_1,canary_2,canary_3;
454: #endif
455: };
456:
457: #define ZEND_MM_SMALL_FREE_BUCKET(heap, index) \
458: (zend_mm_free_block_canary*) ((char*)&heap->free_buckets[index * 2] + \
459: sizeof(zend_mm_free_block_canary*) * 2 - \
460: sizeof(zend_mm_small_free_block_canary))
461:
462: #define ZEND_MM_REST_BUCKET(heap) \
463: (zend_mm_free_block_canary*)((char*)&heap->rest_buckets[0] + \
464: sizeof(zend_mm_free_block_canary*) * 2 - \
465: sizeof(zend_mm_small_free_block_canary))
466:
467: #if ZEND_MM_COOKIES
468:
469: static unsigned int _zend_mm_cookie = 0;
470:
471: # define ZEND_MM_COOKIE(block) \
472: (((size_t)(block)) ^ _zend_mm_cookie)
473: # define ZEND_MM_SET_COOKIE(block) \
474: (block)->info._cookie = ZEND_MM_COOKIE(block)
475: # define ZEND_MM_CHECK_COOKIE(block) \
476: if (UNEXPECTED((block)->info._cookie != ZEND_MM_COOKIE(block))) { \
477: zend_mm_panic("zend_mm_heap corrupted"); \
478: }
479: #else
480: # define ZEND_MM_SET_COOKIE(block)
481: # define ZEND_MM_CHECK_COOKIE(block)
482: #endif
483:
484: /* Default memory segment size */
485: #define ZEND_MM_SEG_SIZE (256 * 1024)
486:
487: /* Reserved space for error reporting in case of memory overflow */
488: #define ZEND_MM_RESERVE_SIZE (8*1024)
489:
490: #ifdef _WIN64
491: # define ZEND_MM_LONG_CONST(x) (x##i64)
492: #else
493: # define ZEND_MM_LONG_CONST(x) (x##L)
494: #endif
495:
496: #define ZEND_MM_TYPE_MASK ZEND_MM_LONG_CONST(0x3)
497:
498: #define ZEND_MM_FREE_BLOCK ZEND_MM_LONG_CONST(0x0)
499: #define ZEND_MM_USED_BLOCK ZEND_MM_LONG_CONST(0x1)
500: #define ZEND_MM_GUARD_BLOCK ZEND_MM_LONG_CONST(0x3)
501:
502: #define ZEND_MM_BLOCK(b, type, size) do { \
503: size_t _size = (size); \
504: (b)->info._size = (type) | _size; \
505: ZEND_MM_BLOCK_AT(b, _size)->info._prev = (type) | _size; \
506: ZEND_MM_SET_COOKIE(b); \
507: } while (0);
508: #define ZEND_MM_LAST_BLOCK(b) do { \
509: (b)->info._size = ZEND_MM_GUARD_BLOCK | ZEND_MM_ALIGNED_HEADER_SIZE; \
510: ZEND_MM_SET_MAGIC(b, MEM_BLOCK_GUARD); \
511: } while (0);
512: #define ZEND_MM_BLOCK_SIZE(b) ((b)->info._size & ~ZEND_MM_TYPE_MASK)
513: #define ZEND_MM_IS_FREE_BLOCK(b) (!((b)->info._size & ZEND_MM_USED_BLOCK))
514: #define ZEND_MM_IS_USED_BLOCK(b) ((b)->info._size & ZEND_MM_USED_BLOCK)
515: #define ZEND_MM_IS_GUARD_BLOCK(b) (((b)->info._size & ZEND_MM_TYPE_MASK) == ZEND_MM_GUARD_BLOCK)
516:
517: #define ZEND_MM_NEXT_BLOCK(b) ZEND_MM_BLOCK_AT(b, ZEND_MM_BLOCK_SIZE(b))
518: #define ZEND_MM_PREV_BLOCK(b) ZEND_MM_BLOCK_AT(b, -(ssize_t)((b)->info._prev & ~ZEND_MM_TYPE_MASK))
519:
520: #define ZEND_MM_PREV_BLOCK_IS_FREE(b) (!((b)->info._prev & ZEND_MM_USED_BLOCK))
521:
522: #define ZEND_MM_MARK_FIRST_BLOCK(b) ((b)->info._prev = ZEND_MM_GUARD_BLOCK)
523: #define ZEND_MM_IS_FIRST_BLOCK(b) ((b)->info._prev == ZEND_MM_GUARD_BLOCK)
524:
525: /* optimized access */
526: #define ZEND_MM_FREE_BLOCK_SIZE(b) (b)->info._size
527:
528: #ifndef ZEND_MM_ALIGNMENT
529: # define ZEND_MM_ALIGNMENT 8
530: # define ZEND_MM_ALIGNMENT_LOG2 3
531: #elif ZEND_MM_ALIGNMENT < 4
532: # undef ZEND_MM_ALIGNMENT
533: # undef ZEND_MM_ALIGNMENT_LOG2
534: # define ZEND_MM_ALIGNMENT 4
535: # define ZEND_MM_ALIGNMENT_LOG2 2
536: #endif
537:
538: #define ZEND_MM_ALIGNMENT_MASK ~(ZEND_MM_ALIGNMENT-1)
539:
540: /* Aligned header size */
541: #define ZEND_MM_ALIGNED_SIZE(size) ((size + ZEND_MM_ALIGNMENT - 1) & ZEND_MM_ALIGNMENT_MASK)
542: #define ZEND_MM_ALIGNED_HEADER_SIZE ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_block_canary))
543: #define ZEND_MM_ALIGNED_FREE_HEADER_SIZE ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_small_free_block_canary))
544: #define ZEND_MM_MIN_ALLOC_BLOCK_SIZE ZEND_MM_ALIGNED_SIZE(ZEND_MM_ALIGNED_HEADER_SIZE + END_MAGIC_SIZE + CANARY_SIZE)
545: #define ZEND_MM_ALIGNED_MIN_HEADER_SIZE (ZEND_MM_MIN_ALLOC_BLOCK_SIZE>ZEND_MM_ALIGNED_FREE_HEADER_SIZE?ZEND_MM_MIN_ALLOC_BLOCK_SIZE:ZEND_MM_ALIGNED_FREE_HEADER_SIZE)
546: #define ZEND_MM_ALIGNED_SEGMENT_SIZE ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_segment))
547:
548: #define ZEND_MM_MIN_SIZE ((ZEND_MM_ALIGNED_MIN_HEADER_SIZE>(ZEND_MM_ALIGNED_HEADER_SIZE+END_MAGIC_SIZE+CANARY_SIZE))?(ZEND_MM_ALIGNED_MIN_HEADER_SIZE-(ZEND_MM_ALIGNED_HEADER_SIZE+END_MAGIC_SIZE+CANARY_SIZE)):0)
549:
550: #define ZEND_MM_MAX_SMALL_SIZE ((ZEND_MM_NUM_BUCKETS<<ZEND_MM_ALIGNMENT_LOG2)+ZEND_MM_ALIGNED_MIN_HEADER_SIZE)
551:
552: #define ZEND_MM_TRUE_SIZE(size) ((size<ZEND_MM_MIN_SIZE)?(ZEND_MM_ALIGNED_MIN_HEADER_SIZE):(ZEND_MM_ALIGNED_SIZE(size+ZEND_MM_ALIGNED_HEADER_SIZE+END_MAGIC_SIZE+CANARY_SIZE)))
553:
554: #define ZEND_MM_BUCKET_INDEX(true_size) ((true_size>>ZEND_MM_ALIGNMENT_LOG2)-(ZEND_MM_ALIGNED_MIN_HEADER_SIZE>>ZEND_MM_ALIGNMENT_LOG2))
555:
556: #define ZEND_MM_SMALL_SIZE(true_size) (true_size < ZEND_MM_MAX_SMALL_SIZE)
557:
558: /* Memory calculations */
559: #define ZEND_MM_BLOCK_AT(blk, offset) ((zend_mm_block_canary *) (((char *) (blk))+(offset)))
560: #define ZEND_MM_DATA_OF(p) ((void *) (((char *) (p))+ZEND_MM_ALIGNED_HEADER_SIZE))
561: #define ZEND_MM_HEADER_OF(blk) ZEND_MM_BLOCK_AT(blk, -(int)ZEND_MM_ALIGNED_HEADER_SIZE)
562:
563: /* Debug output */
564: #if ZEND_DEBUG
565:
566: # ifdef ZTS
567: # define ZEND_MM_SET_THREAD_ID(block) \
568: ((zend_mm_block_canary*)(block))->thread_id = tsrm_thread_id()
569: # define ZEND_MM_BAD_THREAD_ID(block) ((block)->thread_id != tsrm_thread_id())
570: # else
571: # define ZEND_MM_SET_THREAD_ID(block)
572: # define ZEND_MM_BAD_THREAD_ID(block) 0
573: # endif
574:
575: # define ZEND_MM_VALID_PTR(block) \
576: zend_mm_check_ptr(heap, block, 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC)
577:
578: # define ZEND_MM_SET_MAGIC(block, val) do { \
579: (block)->magic = (val); \
580: } while (0)
581:
582: # define ZEND_MM_CHECK_MAGIC(block, val) do { \
583: if ((block)->magic != (val)) { \
584: zend_mm_panic("zend_mm_heap corrupted"); \
585: } \
586: } while (0)
587:
588: # define ZEND_MM_SET_DEBUG_INFO(block, __size, set_valid, set_thread) do { \
589: ((zend_mm_block_canary*)(block))->debug.filename = __zend_filename; \
590: ((zend_mm_block_canary*)(block))->debug.lineno = __zend_lineno; \
591: ((zend_mm_block_canary*)(block))->debug.orig_filename = __zend_orig_filename; \
592: ((zend_mm_block_canary*)(block))->debug.orig_lineno = __zend_orig_lineno; \
593: ZEND_MM_SET_BLOCK_SIZE(block, __size); \
594: if (set_valid) { \
595: ZEND_MM_SET_MAGIC(block, MEM_BLOCK_VALID); \
596: } \
597: if (set_thread) { \
598: ZEND_MM_SET_THREAD_ID(block); \
599: } \
600: } while (0)
601:
602: #else
603:
604: # define ZEND_MM_VALID_PTR(ptr) EXPECTED(ptr != NULL)
605:
606: # define ZEND_MM_SET_MAGIC(block, val)
607:
608: # define ZEND_MM_CHECK_MAGIC(block, val)
609:
610: # define ZEND_MM_SET_DEBUG_INFO(block, __size, set_valid, set_thread) ZEND_MM_SET_BLOCK_SIZE(block, __size)
611:
612: #endif
613:
614: #if SUHOSIN_MM_WITH_CANARY_PROTECTION
615:
616: # define SUHOSIN_MM_CHECK_CANARIES(block, MFUNCTION) do { \
617: char *p = SUHOSIN_MM_END_CANARY_PTR(block); size_t check; \
618: if (((block)->info.canary_1 != heap->canary_1) || ((block)->info.canary_2 != heap->canary_2)) { \
619: canary_mismatch: \
620: zend_suhosin_log(S_MEMORY, "canary mismatch on " MFUNCTION " - heap overflow detected at %p", (block)); \
621: if (SUHOSIN_CONFIG(SUHOSIN_MM_IGNORE_CANARY_VIOLATION) == 0) { _exit(1); } else { (block)->info.canary_1 = heap->canary_1; (block)->info.canary_2 = heap->canary_2; }\
622: } \
623: memcpy(&check, p, CANARY_SIZE); \
624: if (check != heap->canary_3) { \
625: zend_suhosin_log(S_MEMORY, "end canary mismatch on " MFUNCTION " - heap overflow detected at %p", (block)); \
626: if (SUHOSIN_CONFIG(SUHOSIN_MM_IGNORE_CANARY_VIOLATION) == 0) { _exit(1); } else { memcpy(p, heap->canary_3, CANARY_SIZE); } \
627: } \
628: } while (0)
629:
630: # define SUHOSIN_MM_SET_CANARIES(block) do { \
631: (block)->info.canary_1 = heap->canary_1; \
632: (block)->info.canary_2 = heap->canary_2; \
633: } while (0)
634:
635: # define SUHOSIN_MM_END_CANARY_PTR(block) \
636: (char *)(((char*)(ZEND_MM_DATA_OF(block))) + ((zend_mm_block_canary*)(block))->info.size + END_MAGIC_SIZE)
637:
638: # define SUHOSIN_MM_SET_END_CANARY(block) do { \
639: char *p = SUHOSIN_MM_END_CANARY_PTR(block); \
640: memcpy(p, &heap->canary_3, CANARY_SIZE); \
641: } while (0)
642:
643: #else
644:
645: # define SUHOSIN_MM_CHECK_CANARIES(block, MFUNCTION)
646: # define SUHOSIN_MM_SET_CANARIES(block)
647: # define SUHOSIN_MM_END_CANARY_PTR(block)
648: # define SUHOSIN_MM_SET_END_CANARY(block)
649:
650: #endif
651:
652:
653: #if ZEND_MM_HEAP_PROTECTION
654:
655: # define ZEND_MM_CHECK_PROTECTION(block) \
656: do { \
657: if ((block)->debug.start_magic != _mem_block_start_magic || \
658: memcmp(ZEND_MM_END_MAGIC_PTR(block), &_mem_block_end_magic, END_MAGIC_SIZE) != 0) { \
659: zend_mm_panic("zend_mm_heap corrupted"); \
660: } \
661: } while (0)
662:
663: # define ZEND_MM_END_MAGIC_PTR(block) \
664: (((char*)(ZEND_MM_DATA_OF(block))) + ((zend_mm_block_canary*)(block))->debug.size)
665:
666: # define END_MAGIC_SIZE sizeof(unsigned int)
667:
668: # define ZEND_MM_SET_BLOCK_SIZE(block, __size) do { \
669: char *p; \
670: ((zend_mm_block_canary*)(block))->debug.size = (__size); \
671: p = ZEND_MM_END_MAGIC_PTR(block); \
672: ((zend_mm_block_canary*)(block))->debug.start_magic = _mem_block_start_magic; \
673: memcpy(p, &_mem_block_end_magic, END_MAGIC_SIZE); \
674: } while (0)
675:
676: static unsigned int _mem_block_start_magic = 0;
677: static unsigned int _mem_block_end_magic = 0;
678:
679: #else
680:
681: # if ZEND_DEBUG
682: # define ZEND_MM_SET_BLOCK_SIZE(block, _size) \
683: ((zend_mm_block_canary*)(block))->debug.size = (_size)
684: # else
685: # define ZEND_MM_SET_BLOCK_SIZE(block, _size)
686: # endif
687:
688: # define ZEND_MM_CHECK_PROTECTION(block)
689:
690: # define END_MAGIC_SIZE 0
691:
692: #endif
693:
694: #if ZEND_MM_SAFE_UNLINKING
695: # define ZEND_MM_CHECK_BLOCK_LINKAGE(block) \
696: if (UNEXPECTED((block)->info._size != ZEND_MM_BLOCK_AT(block, ZEND_MM_FREE_BLOCK_SIZE(block))->info._prev) || \
697: UNEXPECTED(!UNEXPECTED(ZEND_MM_IS_FIRST_BLOCK(block)) && \
698: UNEXPECTED(ZEND_MM_PREV_BLOCK(block)->info._size != (block)->info._prev))) { \
699: zend_mm_panic("zend_mm_heap corrupted"); \
700: }
701: #define ZEND_MM_CHECK_TREE(block) \
702: if (UNEXPECTED(*((block)->parent) != (block))) { \
703: zend_mm_panic("zend_mm_heap corrupted"); \
704: }
705: #else
706: # define ZEND_MM_CHECK_BLOCK_LINKAGE(block)
707: # define ZEND_MM_CHECK_TREE(block)
708: #endif
709:
710: #define ZEND_MM_LARGE_BUCKET_INDEX(S) zend_mm_high_bit(S)
711:
712: void *_zend_mm_alloc_canary_int(zend_mm_heap_canary *heap, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
713: void _zend_mm_free_canary_int(zend_mm_heap_canary *heap, void *p ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
714: void *_zend_mm_realloc_canary_int(zend_mm_heap_canary *heap, void *p, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
715:
716:
717: static inline unsigned int zend_mm_high_bit(size_t _size)
718: {
719: #if defined(__GNUC__) && defined(i386)
720: unsigned int n;
721:
722: __asm__("bsrl %1,%0\n\t" : "=r" (n) : "rm" (_size));
723: return n;
724: #elif defined(__GNUC__) && defined(__x86_64__)
725: unsigned long n;
726:
727: __asm__("bsrq %1,%0\n\t" : "=r" (n) : "rm" (_size));
728: return (unsigned int)n;
729: #elif defined(_MSC_VER) && defined(_M_IX86)
730: __asm {
731: bsr eax, _size
732: }
733: #else
734: unsigned int n = 0;
735: while (_size != 0) {
736: _size = _size >> 1;
737: n++;
738: }
739: return n-1;
740: #endif
741: }
742:
743: static inline unsigned int zend_mm_low_bit(size_t _size)
744: {
745: #if defined(__GNUC__) && defined(i386)
746: unsigned int n;
747:
748: __asm__("bsfl %1,%0\n\t" : "=r" (n) : "rm" (_size));
749: return n;
750: #elif defined(__GNUC__) && defined(__x86_64__)
751: unsigned long n;
752:
753: __asm__("bsfq %1,%0\n\t" : "=r" (n) : "rm" (_size));
754: return (unsigned int)n;
755: #elif defined(_MSC_VER) && defined(_M_IX86)
756: __asm {
757: bsf eax, _size
758: }
759: #else
760: static const int offset[16] = {4,0,1,0,2,0,1,0,3,0,1,0,2,0,1,0};
761: unsigned int n;
762: unsigned int index = 0;
763:
764: n = offset[_size & 15];
765: while (n == 4) {
766: _size >>= 4;
767: index += n;
768: n = offset[_size & 15];
769: }
770:
771: return index + n;
772: #endif
773: }
774:
775: static void zend_mm_add_to_rest_list(zend_mm_heap_canary *heap, zend_mm_free_block_canary *mm_block)
776: {
777: zend_mm_free_block_canary *prev, *next;
778:
779: ZEND_MM_SET_MAGIC(mm_block, MEM_BLOCK_FREED);
780:
781: if (!ZEND_MM_SMALL_SIZE(ZEND_MM_FREE_BLOCK_SIZE(mm_block))) {
782: mm_block->parent = NULL;
783: }
784:
785: prev = SUHOSIN_MANGLE_PTR(heap->rest_buckets[0]);
786: next = SUHOSIN_MANGLE_PTR(prev->next_free_block);
787: mm_block->prev_free_block = SUHOSIN_MANGLE_PTR(prev);
788: mm_block->next_free_block = SUHOSIN_MANGLE_PTR(next);
789: prev->next_free_block = next->prev_free_block = SUHOSIN_MANGLE_PTR(mm_block);
790: }
791:
792: static void zend_mm_add_to_free_list(zend_mm_heap_canary *heap, zend_mm_free_block_canary *mm_block)
793: {
794: size_t size;
795: size_t index;
796:
797: ZEND_MM_SET_MAGIC(mm_block, MEM_BLOCK_FREED);
798:
799: size = ZEND_MM_FREE_BLOCK_SIZE(mm_block);
800: if (EXPECTED(!ZEND_MM_SMALL_SIZE(size))) {
801: zend_mm_free_block_canary **p;
802:
803: index = ZEND_MM_LARGE_BUCKET_INDEX(size);
804: p = &heap->large_free_buckets[index];
805: mm_block->child[0] = mm_block->child[1] = NULL;
806: if (!*p) {
807: *p = mm_block;
808: mm_block->parent = p;
809: mm_block->prev_free_block = mm_block->next_free_block = SUHOSIN_MANGLE_PTR(mm_block);
810: heap->large_free_bitmap |= (ZEND_MM_LONG_CONST(1) << index);
811: } else {
812: size_t m;
813:
814: for (m = size << (ZEND_MM_NUM_BUCKETS - index); ; m <<= 1) {
815: zend_mm_free_block_canary *prev = *p;
816:
817: if (ZEND_MM_FREE_BLOCK_SIZE(prev) != size) {
818: p = &prev->child[(m >> (ZEND_MM_NUM_BUCKETS-1)) & 1];
819: if (!*p) {
820: *p = mm_block;
821: mm_block->parent = p;
822: mm_block->prev_free_block = mm_block->next_free_block = SUHOSIN_MANGLE_PTR(mm_block);
823: break;
824: }
825: } else {
826: zend_mm_free_block_canary *next = SUHOSIN_MANGLE_PTR(prev->next_free_block);
827:
828: prev->next_free_block = next->prev_free_block = SUHOSIN_MANGLE_PTR(mm_block);
829: mm_block->next_free_block = SUHOSIN_MANGLE_PTR(next);
830: mm_block->prev_free_block = SUHOSIN_MANGLE_PTR(prev);
831: mm_block->parent = NULL;
832: break;
833: }
834: }
835: }
836: } else {
837: zend_mm_free_block_canary *prev, *next;
838:
839: index = ZEND_MM_BUCKET_INDEX(size);
840:
841: prev = ZEND_MM_SMALL_FREE_BUCKET(heap, index);
842: if (SUHOSIN_MANGLE_PTR(prev->prev_free_block) == prev) {
843: heap->free_bitmap |= (ZEND_MM_LONG_CONST(1) << index);
844: }
845: next = SUHOSIN_MANGLE_PTR(prev->next_free_block);
846:
847: mm_block->prev_free_block = SUHOSIN_MANGLE_PTR(prev);
848: mm_block->next_free_block = SUHOSIN_MANGLE_PTR(next);
849: prev->next_free_block = next->prev_free_block = SUHOSIN_MANGLE_PTR(mm_block);
850: }
851: }
852:
853: static void zend_mm_remove_from_free_list(zend_mm_heap_canary *heap, zend_mm_free_block_canary *mm_block)
854: {
855: zend_mm_free_block_canary *prev = SUHOSIN_MANGLE_PTR(mm_block->prev_free_block);
856: zend_mm_free_block_canary *next = SUHOSIN_MANGLE_PTR(mm_block->next_free_block);
857:
858: ZEND_MM_CHECK_MAGIC(mm_block, MEM_BLOCK_FREED);
859:
860: if (EXPECTED(prev == mm_block)) {
861: zend_mm_free_block_canary **rp, **cp;
862:
863: #if SUHOSIN_PATCH
864: if (next != mm_block) {
865: zend_suhosin_log(S_MEMORY, "zend_mm_heap corrupted at %p", mm_block);
866: _exit(1);
867: }
868: #endif
869: #if ZEND_MM_SAFE_UNLINKING
870: if (UNEXPECTED(next != mm_block)) {
871: zend_mm_panic("zend_mm_heap corrupted");
872: }
873: #endif
874:
875: rp = &mm_block->child[mm_block->child[1] != NULL];
876: prev = *rp;
877: if (EXPECTED(prev == NULL)) {
878: size_t index = ZEND_MM_LARGE_BUCKET_INDEX(ZEND_MM_FREE_BLOCK_SIZE(mm_block));
879:
880: ZEND_MM_CHECK_TREE(mm_block);
881: *mm_block->parent = NULL;
882: if (mm_block->parent == &heap->large_free_buckets[index]) {
883: heap->large_free_bitmap &= ~(ZEND_MM_LONG_CONST(1) << index);
884: }
885: } else {
886: while (*(cp = &(prev->child[prev->child[1] != NULL])) != NULL) {
887: prev = *cp;
888: rp = cp;
889: }
890: *rp = NULL;
891:
892: subst_block:
893: ZEND_MM_CHECK_TREE(mm_block);
894: *mm_block->parent = prev;
895: prev->parent = mm_block->parent;
896: if ((prev->child[0] = mm_block->child[0])) {
897: ZEND_MM_CHECK_TREE(prev->child[0]);
898: prev->child[0]->parent = &prev->child[0];
899: }
900: if ((prev->child[1] = mm_block->child[1])) {
901: ZEND_MM_CHECK_TREE(prev->child[1]);
902: prev->child[1]->parent = &prev->child[1];
903: }
904: }
905: } else {
906:
907: #if SUHOSIN_PATCH
908: if (SUHOSIN_MANGLE_PTR(prev->next_free_block) != mm_block || SUHOSIN_MANGLE_PTR(next->prev_free_block) != mm_block) {
909: zend_suhosin_log(S_MEMORY, "zend_mm_head corrupted at %p", mm_block);
910: _exit(1);
911: }
912: #endif
913:
914: #if ZEND_MM_SAFE_UNLINKING
915: if (UNEXPECTED(SUHOSIN_MANGLE_PTR(prev->next_free_block) != mm_block) || UNEXPECTED(SUHOSIN_MANGLE_PTR(next->prev_free_block) != mm_block)) {
916: zend_mm_panic("zend_mm_heap corrupted");
917: }
918: #endif
919:
920: prev->next_free_block = SUHOSIN_MANGLE_PTR(next);
921: next->prev_free_block = SUHOSIN_MANGLE_PTR(prev);
922:
923: if (EXPECTED(ZEND_MM_SMALL_SIZE(ZEND_MM_FREE_BLOCK_SIZE(mm_block)))) {
924: if (EXPECTED(prev == next)) {
925: size_t index = ZEND_MM_BUCKET_INDEX(ZEND_MM_FREE_BLOCK_SIZE(mm_block));
926:
927: if (EXPECTED(heap->free_buckets[index*2] == heap->free_buckets[index*2+1])) {
928: heap->free_bitmap &= ~(ZEND_MM_LONG_CONST(1) << index);
929: }
930: }
931: } else if (UNEXPECTED(mm_block->parent != NULL)) {
932: goto subst_block;
933: }
934: }
935: }
936:
937: static void zend_mm_init(zend_mm_heap_canary *heap)
938: {
939: zend_mm_free_block_canary* p;
940: int i;
941:
942: heap->free_bitmap = 0;
943: heap->large_free_bitmap = 0;
944: #if ZEND_MM_CACHE
945: heap->cached = 0;
946: memset(heap->cache, 0, sizeof(heap->cache));
947: #endif
948: #if ZEND_MM_CACHE_STAT
949: for (i = 0; i < ZEND_MM_NUM_BUCKETS; i++) {
950: heap->cache_stat[i].count = 0;
951: }
952: #endif
953: p = ZEND_MM_SMALL_FREE_BUCKET(heap, 0);
954: for (i = 0; i < ZEND_MM_NUM_BUCKETS; i++) {
955: p->next_free_block = SUHOSIN_MANGLE_PTR(p);
956: p->prev_free_block = SUHOSIN_MANGLE_PTR(p);
957: p = (zend_mm_free_block_canary*)((char*)p + sizeof(zend_mm_free_block_canary*) * 2);
958: heap->large_free_buckets[i] = NULL;
959: }
960: heap->rest_buckets[0] = heap->rest_buckets[1] = SUHOSIN_MANGLE_PTR(ZEND_MM_REST_BUCKET(heap));
961: #if SUHOSIN_PATCH
962: if (SUHOSIN_CONFIG(SUHOSIN_MM_USE_CANARY_PROTECTION)) {
963: zend_canary(&heap->canary_1, sizeof(heap->canary_1));
964: zend_canary(&heap->canary_2, sizeof(heap->canary_2));
965: zend_canary(&heap->canary_3, sizeof(heap->canary_3));
966: }
967: #endif
968: }
969:
970: static void zend_mm_del_segment(zend_mm_heap_canary *heap, zend_mm_segment *segment)
971: {
972: zend_mm_segment **p = &heap->segments_list;
973:
974: while (*p != segment) {
975: p = &(*p)->next_segment;
976: }
977: *p = segment->next_segment;
978: heap->real_size -= segment->size;
979: ZEND_MM_STORAGE_FREE(segment);
980: }
981:
982: #if ZEND_MM_CACHE
983: static void zend_mm_free_cache(zend_mm_heap_canary *heap)
984: {
985: int i;
986:
987: for (i = 0; i < ZEND_MM_NUM_BUCKETS; i++) {
988: /* SUHOSIN_MANGLE_PTR should NOT affect NULL pointers */
989: if (heap->cache[i]) {
990: zend_mm_free_block_canary *mm_block = SUHOSIN_MANGLE_PTR(heap->cache[i]);
991:
992: while (mm_block) {
993: size_t size = ZEND_MM_BLOCK_SIZE(mm_block);
994: zend_mm_free_block_canary *q = SUHOSIN_MANGLE_PTR(mm_block->prev_free_block);
995: zend_mm_block_canary *next_block = ZEND_MM_NEXT_BLOCK(mm_block);
996:
997: heap->cached -= size;
998:
999: if (ZEND_MM_PREV_BLOCK_IS_FREE(mm_block)) {
1000: mm_block = (zend_mm_free_block_canary*)ZEND_MM_PREV_BLOCK(mm_block);
1001: size += ZEND_MM_FREE_BLOCK_SIZE(mm_block);
1002: zend_mm_remove_from_free_list(heap, (zend_mm_free_block_canary *) mm_block);
1003: }
1004: if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
1005: size += ZEND_MM_FREE_BLOCK_SIZE(next_block);
1006: zend_mm_remove_from_free_list(heap, (zend_mm_free_block_canary *) next_block);
1007: }
1008: ZEND_MM_BLOCK(mm_block, ZEND_MM_FREE_BLOCK, size);
1009:
1010: if (ZEND_MM_IS_FIRST_BLOCK(mm_block) &&
1011: ZEND_MM_IS_GUARD_BLOCK(ZEND_MM_NEXT_BLOCK(mm_block))) {
1012: zend_mm_del_segment(heap, (zend_mm_segment *) ((char *)mm_block - ZEND_MM_ALIGNED_SEGMENT_SIZE));
1013: } else {
1014: zend_mm_add_to_free_list(heap, (zend_mm_free_block_canary *) mm_block);
1015: }
1016:
1017: mm_block = q;
1018: }
1019: heap->cache[i] = NULL;
1020: #if ZEND_MM_CACHE_STAT
1021: heap->cache_stat[i].count = 0;
1022: #endif
1023: }
1024: }
1025: }
1026: #endif
1027:
1028: #if ZEND_MM_HEAP_PROTECTION || ZEND_MM_COOKIES
1029: static void zend_mm_random(unsigned char *buf, size_t size) /* {{{ */
1030: {
1031: size_t i = 0;
1032: unsigned char t;
1033:
1034: #ifdef ZEND_WIN32
1035: HCRYPTPROV hCryptProv;
1036: int has_context = 0;
1037:
1038: if (!CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, 0)) {
1039: /* Could mean that the key container does not exist, let try
1040: again by asking for a new one */
1041: if (GetLastError() == NTE_BAD_KEYSET) {
1042: if (CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET)) {
1043: has_context = 1;
1044: }
1045: }
1046: } else {
1047: has_context = 1;
1048: }
1049: if (has_context) {
1050: do {
1051: BOOL ret = CryptGenRandom(hCryptProv, size, buf);
1052: CryptReleaseContext(hCryptProv, 0);
1053: if (ret) {
1054: while (i < size && buf[i] != 0) {
1055: i++;
1056: }
1057: if (i == size) {
1058: return;
1059: }
1060: }
1061: } while (0);
1062: }
1063: #elif defined(HAVE_DEV_URANDOM)
1064: int fd = open("/dev/urandom", 0);
1065:
1066: if (fd >= 0) {
1067: if (read(fd, buf, size) == size) {
1068: while (i < size && buf[i] != 0) {
1069: i++;
1070: }
1071: if (i == size) {
1072: close(fd);
1073: return;
1074: }
1075: }
1076: close(fd);
1077: }
1078: #endif
1079: t = (unsigned char)getpid();
1080: while (i < size) {
1081: do {
1082: buf[i] = ((unsigned char)rand()) ^ t;
1083: } while (buf[i] == 0);
1084: t = buf[i++] << 1;
1085: }
1086: }
1087: /* }}} */
1088: #endif
1089:
1090:
1091: /* Notes:
1092: * - This function may alter the block_sizes values to match platform alignment
1093: * - This function does *not* perform sanity checks on the arguments
1094: */
1095: zend_mm_heap_canary *__zend_mm_startup_canary_ex(const zend_mm_mem_handlers *handlers, size_t block_size, size_t reserve_size, int internal, void *params)
1096: {
1097: zend_mm_storage *storage;
1098: zend_mm_heap_canary *heap;
1099: zend_mm_free_block_canary *tmp;
1100:
1101: #if 0
1102: int i;
1103:
1104: printf("ZEND_MM_ALIGNMENT=%d\n", ZEND_MM_ALIGNMENT);
1105: printf("ZEND_MM_ALIGNMENT_LOG2=%d\n", ZEND_MM_ALIGNMENT_LOG2);
1106: printf("ZEND_MM_MIN_SIZE=%d\n", ZEND_MM_MIN_SIZE);
1107: printf("ZEND_MM_MAX_SMALL_SIZE=%d\n", ZEND_MM_MAX_SMALL_SIZE);
1108: printf("ZEND_MM_ALIGNED_HEADER_SIZE=%d\n", ZEND_MM_ALIGNED_HEADER_SIZE);
1109: printf("ZEND_MM_ALIGNED_FREE_HEADER_SIZE=%d\n", ZEND_MM_ALIGNED_FREE_HEADER_SIZE);
1110: printf("ZEND_MM_MIN_ALLOC_BLOCK_SIZE=%d\n", ZEND_MM_MIN_ALLOC_BLOCK_SIZE);
1111: printf("ZEND_MM_ALIGNED_MIN_HEADER_SIZE=%d\n", ZEND_MM_ALIGNED_MIN_HEADER_SIZE);
1112: printf("ZEND_MM_ALIGNED_SEGMENT_SIZE=%d\n", ZEND_MM_ALIGNED_SEGMENT_SIZE);
1113: for (i = 0; i < ZEND_MM_MAX_SMALL_SIZE; i++) {
1114: printf("%3d%c: %3ld %d %2ld\n", i, (i == ZEND_MM_MIN_SIZE?'*':' '), (long)ZEND_MM_TRUE_SIZE(i), ZEND_MM_SMALL_SIZE(ZEND_MM_TRUE_SIZE(i)), (long)ZEND_MM_BUCKET_INDEX(ZEND_MM_TRUE_SIZE(i)));
1115: }
1116: exit(0);
1117: #endif
1118:
1119: #if ZEND_MM_HEAP_PROTECTION
1120: if (_mem_block_start_magic == 0) {
1121: zend_mm_random((unsigned char*)&_mem_block_start_magic, sizeof(_mem_block_start_magic));
1122: }
1123: if (_mem_block_end_magic == 0) {
1124: zend_mm_random((unsigned char*)&_mem_block_end_magic, sizeof(_mem_block_end_magic));
1125: }
1126: #endif
1127: #if ZEND_MM_COOKIES
1128: if (_zend_mm_cookie == 0) {
1129: zend_mm_random((unsigned char*)&_zend_mm_cookie, sizeof(_zend_mm_cookie));
1130: }
1131: #endif
1132:
1133: /* get the pointer guardian and ensure low 3 bits are 1 */
1134: if (SUHOSIN_POINTER_GUARD == 0) {
1135: zend_canary(&SUHOSIN_POINTER_GUARD, sizeof(SUHOSIN_POINTER_GUARD));
1136: SUHOSIN_POINTER_GUARD |= 7;
1137: }
1138:
1139: if (zend_mm_low_bit(block_size) != zend_mm_high_bit(block_size)) {
1140: fprintf(stderr, "'block_size' must be a power of two\n");
1141: /* See http://support.microsoft.com/kb/190351 */
1142: #ifdef PHP_WIN32
1143: fflush(stderr);
1144: #endif
1145: exit(255);
1146: }
1147: storage = handlers->init(params);
1148: if (!storage) {
1149: fprintf(stderr, "Cannot initialize zend_mm storage [%s]\n", handlers->name);
1150: /* See http://support.microsoft.com/kb/190351 */
1151: #ifdef PHP_WIN32
1152: fflush(stderr);
1153: #endif
1154: exit(255);
1155: }
1156: storage->handlers = handlers;
1157:
1158: heap = malloc(sizeof(struct _zend_mm_heap_canary));
1159: if (heap == NULL) {
1160: fprintf(stderr, "Cannot allocate heap for zend_mm storage [%s]\n", handlers->name);
1161: #ifdef PHP_WIN32
1162: fflush(stderr);
1163: #endif
1164: exit(255);
1165: }
1166:
1167: heap->storage = storage;
1168: heap->block_size = block_size;
1169: heap->compact_size = 0;
1170: heap->segments_list = NULL;
1171: zend_mm_init(heap);
1172: # if ZEND_MM_CACHE_STAT
1173: memset(heap->cache_stat, 0, sizeof(heap->cache_stat));
1174: # endif
1175:
1176: heap->use_zend_alloc = 1;
1177: heap->real_size = 0;
1178: heap->overflow = 0;
1179: heap->real_peak = 0;
1180: heap->limit = ZEND_MM_LONG_CONST(1)<<(ZEND_MM_NUM_BUCKETS-2);
1181: heap->size = 0;
1182: heap->peak = 0;
1183: heap->internal = internal;
1184: heap->reserve = NULL;
1185: heap->reserve_size = reserve_size;
1186: if (reserve_size > 0) {
1187: heap->reserve = _zend_mm_alloc((zend_mm_heap *)heap, reserve_size ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
1188: }
1189: if (internal) {
1190: int i;
1191: zend_mm_free_block_canary *p, *q, *orig;
1192: zend_mm_heap_canary *mm_heap = _zend_mm_alloc((zend_mm_heap *)heap, sizeof(zend_mm_heap_canary) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
1193:
1194: *mm_heap = *heap;
1195:
1196: p = ZEND_MM_SMALL_FREE_BUCKET(mm_heap, 0);
1197: orig = ZEND_MM_SMALL_FREE_BUCKET(heap, 0);
1198: for (i = 0; i < ZEND_MM_NUM_BUCKETS; i++) {
1199: q = p;
1200: while (SUHOSIN_MANGLE_PTR(q->prev_free_block) != orig) {
1201: q = SUHOSIN_MANGLE_PTR(q->prev_free_block);
1202: }
1203: q->prev_free_block = SUHOSIN_MANGLE_PTR(p);
1204: q = p;
1205: while (SUHOSIN_MANGLE_PTR(q->next_free_block) != orig) {
1206: q = SUHOSIN_MANGLE_PTR(q->next_free_block);
1207: }
1208: q->next_free_block = SUHOSIN_MANGLE_PTR(p);
1209: p = (zend_mm_free_block_canary*)((char*)p + sizeof(zend_mm_free_block_canary*) * 2);
1210: orig = (zend_mm_free_block_canary*)((char*)orig + sizeof(zend_mm_free_block_canary*) * 2);
1211: if (mm_heap->large_free_buckets[i]) {
1212: mm_heap->large_free_buckets[i]->parent = &mm_heap->large_free_buckets[i];
1213: }
1214: }
1215: mm_heap->rest_buckets[0] = mm_heap->rest_buckets[1] = SUHOSIN_MANGLE_PTR(ZEND_MM_REST_BUCKET(mm_heap));
1216:
1217: free(heap);
1218: heap = mm_heap;
1219: }
1220: return heap;
1221: }
1222:
1223: zend_mm_heap_canary *__zend_mm_startup_canary(void)
1224: {
1225: int i;
1226: size_t seg_size;
1227: char *mem_type = getenv("ZEND_MM_MEM_TYPE");
1228: char *tmp;
1229: const zend_mm_mem_handlers *handlers;
1230: zend_mm_heap_canary *heap;
1231:
1232: if (mem_type == NULL) {
1233: i = 0;
1234: } else {
1235: for (i = 0; mem_handlers[i].name; i++) {
1236: if (strcmp(mem_handlers[i].name, mem_type) == 0) {
1237: break;
1238: }
1239: }
1240: if (!mem_handlers[i].name) {
1241: fprintf(stderr, "Wrong or unsupported zend_mm storage type '%s'\n", mem_type);
1242: fprintf(stderr, " supported types:\n");
1243: /* See http://support.microsoft.com/kb/190351 */
1244: #ifdef PHP_WIN32
1245: fflush(stderr);
1246: #endif
1247: for (i = 0; mem_handlers[i].name; i++) {
1248: fprintf(stderr, " '%s'\n", mem_handlers[i].name);
1249: }
1250: /* See http://support.microsoft.com/kb/190351 */
1251: #ifdef PHP_WIN32
1252: fflush(stderr);
1253: #endif
1254: exit(255);
1255: }
1256: }
1257: handlers = &mem_handlers[i];
1258:
1259: tmp = getenv("ZEND_MM_SEG_SIZE");
1260: if (tmp) {
1261: seg_size = zend_atoi(tmp, 0);
1262: if (zend_mm_low_bit(seg_size) != zend_mm_high_bit(seg_size)) {
1263: fprintf(stderr, "ZEND_MM_SEG_SIZE must be a power of two\n");
1264: /* See http://support.microsoft.com/kb/190351 */
1265: #ifdef PHP_WIN32
1266: fflush(stderr);
1267: #endif
1268: exit(255);
1269: } else if (seg_size < ZEND_MM_ALIGNED_SEGMENT_SIZE + ZEND_MM_ALIGNED_HEADER_SIZE) {
1270: fprintf(stderr, "ZEND_MM_SEG_SIZE is too small\n");
1271: /* See http://support.microsoft.com/kb/190351 */
1272: #ifdef PHP_WIN32
1273: fflush(stderr);
1274: #endif
1275: exit(255);
1276: }
1277: } else {
1278: seg_size = ZEND_MM_SEG_SIZE;
1279: }
1280:
1281: heap = __zend_mm_startup_canary_ex(handlers, seg_size, ZEND_MM_RESERVE_SIZE, 0, NULL);
1282: if (heap) {
1283: tmp = getenv("ZEND_MM_COMPACT");
1284: if (tmp) {
1285: heap->compact_size = zend_atoi(tmp, 0);
1286: } else {
1287: heap->compact_size = 2 * 1024 * 1024;
1288: }
1289: }
1290: return heap;
1291: }
1292:
1293: #if ZEND_DEBUG
1294: static long zend_mm_find_leaks(zend_mm_segment *segment, zend_mm_block_canary *b)
1295: {
1296: long leaks = 0;
1297: zend_mm_block_canary *p, *q;
1298:
1299: p = ZEND_MM_NEXT_BLOCK(b);
1300: while (1) {
1301: if (ZEND_MM_IS_GUARD_BLOCK(p)) {
1302: ZEND_MM_CHECK_MAGIC(p, MEM_BLOCK_GUARD);
1303: segment = segment->next_segment;
1304: if (!segment) {
1305: break;
1306: }
1307: p = (zend_mm_block_canary *) ((char *) segment + ZEND_MM_ALIGNED_SEGMENT_SIZE);
1308: continue;
1309: }
1310: q = ZEND_MM_NEXT_BLOCK(p);
1311: if (q <= p ||
1312: (char*)q > (char*)segment + segment->size ||
1313: p->info._size != q->info._prev) {
1314: zend_mm_panic("zend_mm_heap corrupted");
1315: }
1316: if (!ZEND_MM_IS_FREE_BLOCK(p)) {
1317: if (p->magic == MEM_BLOCK_VALID) {
1318: if (p->debug.filename==b->debug.filename && p->debug.lineno==b->debug.lineno) {
1319: ZEND_MM_SET_MAGIC(p, MEM_BLOCK_LEAK);
1320: leaks++;
1321: }
1322: #if ZEND_MM_CACHE
1323: } else if (p->magic == MEM_BLOCK_CACHED) {
1324: /* skip it */
1325: #endif
1326: } else if (p->magic != MEM_BLOCK_LEAK) {
1327: zend_mm_panic("zend_mm_heap corrupted");
1328: }
1329: }
1330: p = q;
1331: }
1332: return leaks;
1333: }
1334:
1335: static void zend_mm_check_leaks(zend_mm_heap_canary *heap TSRMLS_DC)
1336: {
1337: zend_mm_segment *segment = heap->segments_list;
1338: zend_mm_block_canary *p, *q;
1339: zend_uint total = 0;
1340:
1341: if (!segment) {
1342: return;
1343: }
1344: p = (zend_mm_block_canary *) ((char *) segment + ZEND_MM_ALIGNED_SEGMENT_SIZE);
1345: while (1) {
1346: q = ZEND_MM_NEXT_BLOCK(p);
1347: if (q <= p ||
1348: (char*)q > (char*)segment + segment->size ||
1349: p->info._size != q->info._prev) {
1350: zend_mm_panic("zend_mm_heap corrupted");
1351: }
1352: if (!ZEND_MM_IS_FREE_BLOCK(p)) {
1353: if (p->magic == MEM_BLOCK_VALID) {
1354: long repeated;
1355: zend_leak_info leak;
1356:
1357: ZEND_MM_SET_MAGIC(p, MEM_BLOCK_LEAK);
1358:
1359: leak.addr = ZEND_MM_DATA_OF(p);
1360: leak.size = p->debug.size;
1361: leak.filename = p->debug.filename;
1362: leak.lineno = p->debug.lineno;
1363: leak.orig_filename = p->debug.orig_filename;
1364: leak.orig_lineno = p->debug.orig_lineno;
1365:
1366: zend_message_dispatcher(ZMSG_LOG_SCRIPT_NAME, NULL TSRMLS_CC);
1367: zend_message_dispatcher(ZMSG_MEMORY_LEAK_DETECTED, &leak TSRMLS_CC);
1368: repeated = zend_mm_find_leaks(segment, p);
1369: total += 1 + repeated;
1370: if (repeated) {
1371: zend_message_dispatcher(ZMSG_MEMORY_LEAK_REPEATED, (void *)(zend_uintptr_t)repeated TSRMLS_CC);
1372: }
1373: #if ZEND_MM_CACHE
1374: } else if (p->magic == MEM_BLOCK_CACHED) {
1375: /* skip it */
1376: #endif
1377: } else if (p->magic != MEM_BLOCK_LEAK) {
1378: zend_mm_panic("zend_mm_heap corrupted");
1379: }
1380: }
1381: if (ZEND_MM_IS_GUARD_BLOCK(q)) {
1382: segment = segment->next_segment;
1383: if (!segment) {
1384: break;
1385: }
1386: q = (zend_mm_block_canary *) ((char *) segment + ZEND_MM_ALIGNED_SEGMENT_SIZE);
1387: }
1388: p = q;
1389: }
1390: if (total) {
1391: zend_message_dispatcher(ZMSG_MEMORY_LEAKS_GRAND_TOTAL, &total TSRMLS_CC);
1392: }
1393: }
1394:
1395: static int zend_mm_check_ptr(zend_mm_heap_canary *heap, void *ptr, int silent ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
1396: {
1397: zend_mm_block_canary *p;
1398: int no_cache_notice = 0;
1399: int had_problems = 0;
1400: int valid_beginning = 1;
1401:
1402: if (silent==2) {
1403: silent = 1;
1404: no_cache_notice = 1;
1405: } else if (silent==3) {
1406: silent = 0;
1407: no_cache_notice = 1;
1408: }
1409: if (!silent) {
1410: TSRMLS_FETCH();
1411:
1412: zend_message_dispatcher(ZMSG_LOG_SCRIPT_NAME, NULL TSRMLS_CC);
1413: zend_debug_alloc_output("---------------------------------------\n");
1414: zend_debug_alloc_output("%s(%d) : Block "PTR_FMT" status:\n" ZEND_FILE_LINE_RELAY_CC, ptr);
1415: if (__zend_orig_filename) {
1416: zend_debug_alloc_output("%s(%d) : Actual location (location was relayed)\n" ZEND_FILE_LINE_ORIG_RELAY_CC);
1417: }
1418: if (!ptr) {
1419: zend_debug_alloc_output("NULL\n");
1420: zend_debug_alloc_output("---------------------------------------\n");
1421: return 0;
1422: }
1423: }
1424:
1425: if (!ptr) {
1426: if (silent) {
1427: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1428: }
1429: }
1430:
1431: p = ZEND_MM_HEADER_OF(ptr);
1432:
1433: #ifdef ZTS
1434: if (ZEND_MM_BAD_THREAD_ID(p)) {
1435: if (!silent) {
1436: zend_debug_alloc_output("Invalid pointer: ((thread_id=0x%0.8X) != (expected=0x%0.8X))\n", (long)p->thread_id, (long)tsrm_thread_id());
1437: had_problems = 1;
1438: } else {
1439: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1440: }
1441: }
1442: #endif
1443:
1444: if (p->info._size != ZEND_MM_NEXT_BLOCK(p)->info._prev) {
1445: if (!silent) {
1446: zend_debug_alloc_output("Invalid pointer: ((size="PTR_FMT") != (next.prev="PTR_FMT"))\n", p->info._size, ZEND_MM_NEXT_BLOCK(p)->info._prev);
1447: had_problems = 1;
1448: } else {
1449: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1450: }
1451: }
1452: if (p->info._prev != ZEND_MM_GUARD_BLOCK &&
1453: ZEND_MM_PREV_BLOCK(p)->info._size != p->info._prev) {
1454: if (!silent) {
1455: zend_debug_alloc_output("Invalid pointer: ((prev="PTR_FMT") != (prev.size="PTR_FMT"))\n", p->info._prev, ZEND_MM_PREV_BLOCK(p)->info._size);
1456: had_problems = 1;
1457: } else {
1458: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1459: }
1460: }
1461:
1462: if (had_problems) {
1463: zend_debug_alloc_output("---------------------------------------\n");
1464: return 0;
1465: }
1466:
1467: if (!silent) {
1468: zend_debug_alloc_output("%10s\t","Beginning: ");
1469: }
1470:
1471: if (!ZEND_MM_IS_USED_BLOCK(p)) {
1472: if (!silent) {
1473: if (p->magic != MEM_BLOCK_FREED) {
1474: zend_debug_alloc_output("Freed (magic=0x%0.8X, expected=0x%0.8X)\n", p->magic, MEM_BLOCK_FREED);
1475: } else {
1476: zend_debug_alloc_output("Freed\n");
1477: }
1478: had_problems = 1;
1479: } else {
1480: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1481: }
1482: } else if (ZEND_MM_IS_GUARD_BLOCK(p)) {
1483: if (!silent) {
1484: if (p->magic != MEM_BLOCK_FREED) {
1485: zend_debug_alloc_output("Guard (magic=0x%0.8X, expected=0x%0.8X)\n", p->magic, MEM_BLOCK_FREED);
1486: } else {
1487: zend_debug_alloc_output("Guard\n");
1488: }
1489: had_problems = 1;
1490: } else {
1491: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1492: }
1493: } else {
1494: switch (p->magic) {
1495: case MEM_BLOCK_VALID:
1496: case MEM_BLOCK_LEAK:
1497: if (!silent) {
1498: zend_debug_alloc_output("OK (allocated on %s:%d, %d bytes)\n", p->debug.filename, p->debug.lineno, (int)p->debug.size);
1499: }
1500: break; /* ok */
1501: case MEM_BLOCK_CACHED:
1502: if (!no_cache_notice) {
1503: if (!silent) {
1504: zend_debug_alloc_output("Cached\n");
1505: had_problems = 1;
1506: } else {
1507: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1508: }
1509: }
1510: case MEM_BLOCK_FREED:
1511: if (!silent) {
1512: zend_debug_alloc_output("Freed (invalid)\n");
1513: had_problems = 1;
1514: } else {
1515: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1516: }
1517: break;
1518: case MEM_BLOCK_GUARD:
1519: if (!silent) {
1520: zend_debug_alloc_output("Guard (invalid)\n");
1521: had_problems = 1;
1522: } else {
1523: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1524: }
1525: break;
1526: default:
1527: if (!silent) {
1528: zend_debug_alloc_output("Unknown (magic=0x%0.8X, expected=0x%0.8X)\n", p->magic, MEM_BLOCK_VALID);
1529: had_problems = 1;
1530: valid_beginning = 0;
1531: } else {
1532: return zend_mm_check_ptr(heap, ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1533: }
1534: break;
1535: }
1536: }
1537:
1538: #if ZEND_MM_HEAP_PROTECTION
1539: if (!valid_beginning) {
1540: if (!silent) {
1541: zend_debug_alloc_output("%10s\t", "Start:");
1542: zend_debug_alloc_output("Unknown\n");
1543: zend_debug_alloc_output("%10s\t", "End:");
1544: zend_debug_alloc_output("Unknown\n");
1545: }
1546: } else {
1547: char *end_magic = ZEND_MM_END_MAGIC_PTR(p);
1548:
1549: if (p->debug.start_magic == _mem_block_start_magic) {
1550: if (!silent) {
1551: zend_debug_alloc_output("%10s\t", "Start:");
1552: zend_debug_alloc_output("OK\n");
1553: }
1554: } else {
1555: char *overflow_ptr, *magic_ptr=(char *) &_mem_block_start_magic;
1556: int overflows=0;
1557: int i;
1558:
1559: if (silent) {
1560: return _mem_block_check(ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1561: }
1562: had_problems = 1;
1563: overflow_ptr = (char *) &p->debug.start_magic;
1564: i = END_MAGIC_SIZE;
1565: while (--i >= 0) {
1566: if (overflow_ptr[i]!=magic_ptr[i]) {
1567: overflows++;
1568: }
1569: }
1570: zend_debug_alloc_output("%10s\t", "Start:");
1571: zend_debug_alloc_output("Overflown (magic=0x%0.8X instead of 0x%0.8X)\n", p->debug.start_magic, _mem_block_start_magic);
1572: zend_debug_alloc_output("%10s\t","");
1573: if (overflows >= END_MAGIC_SIZE) {
1574: zend_debug_alloc_output("At least %d bytes overflown\n", END_MAGIC_SIZE);
1575: } else {
1576: zend_debug_alloc_output("%d byte(s) overflown\n", overflows);
1577: }
1578: }
1579: if (memcmp(end_magic, &_mem_block_end_magic, END_MAGIC_SIZE)==0) {
1580: if (!silent) {
1581: zend_debug_alloc_output("%10s\t", "End:");
1582: zend_debug_alloc_output("OK\n");
1583: }
1584: } else {
1585: char *overflow_ptr, *magic_ptr=(char *) &_mem_block_end_magic;
1586: int overflows=0;
1587: int i;
1588:
1589: if (silent) {
1590: return _mem_block_check(ptr, 0 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
1591: }
1592: had_problems = 1;
1593: overflow_ptr = (char *) end_magic;
1594:
1595: for (i=0; i < END_MAGIC_SIZE; i++) {
1596: if (overflow_ptr[i]!=magic_ptr[i]) {
1597: overflows++;
1598: }
1599: }
1600:
1601: zend_debug_alloc_output("%10s\t", "End:");
1602: zend_debug_alloc_output("Overflown (magic=0x%0.8X instead of 0x%0.8X)\n", *end_magic, _mem_block_end_magic);
1603: zend_debug_alloc_output("%10s\t","");
1604: if (overflows >= END_MAGIC_SIZE) {
1605: zend_debug_alloc_output("At least %d bytes overflown\n", END_MAGIC_SIZE);
1606: } else {
1607: zend_debug_alloc_output("%d byte(s) overflown\n", overflows);
1608: }
1609: }
1610: }
1611: #endif
1612:
1613: if (!silent) {
1614: zend_debug_alloc_output("---------------------------------------\n");
1615: }
1616: return ((!had_problems) ? 1 : 0);
1617: }
1618:
1619: static int zend_mm_check_heap(zend_mm_heap_canary *heap, int silent ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
1620: {
1621: zend_mm_segment *segment = heap->segments_list;
1622: zend_mm_block_canary *p, *q;
1623: int errors = 0;
1624:
1625: if (!segment) {
1626: return 0;
1627: }
1628: p = (zend_mm_block_canary *) ((char *) segment + ZEND_MM_ALIGNED_SEGMENT_SIZE);
1629: while (1) {
1630: q = ZEND_MM_NEXT_BLOCK(p);
1631: if (q <= p ||
1632: (char*)q > (char*)segment + segment->size ||
1633: p->info._size != q->info._prev) {
1634: zend_mm_panic("zend_mm_heap corrupted");
1635: }
1636: if (!ZEND_MM_IS_FREE_BLOCK(p)) {
1637: if (p->magic == MEM_BLOCK_VALID || p->magic == MEM_BLOCK_LEAK) {
1638: if (!zend_mm_check_ptr(heap, ZEND_MM_DATA_OF(p), (silent?2:3) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC)) {
1639: errors++;
1640: }
1641: #if ZEND_MM_CACHE
1642: } else if (p->magic == MEM_BLOCK_CACHED) {
1643: /* skip it */
1644: #endif
1645: } else if (p->magic != MEM_BLOCK_LEAK) {
1646: zend_mm_panic("zend_mm_heap corrupted");
1647: }
1648: }
1649: if (ZEND_MM_IS_GUARD_BLOCK(q)) {
1650: segment = segment->next_segment;
1651: if (!segment) {
1652: return errors;
1653: }
1654: q = (zend_mm_block_canary *) ((char *) segment + ZEND_MM_ALIGNED_SEGMENT_SIZE);
1655: }
1656: p = q;
1657: }
1658: }
1659: #endif
1660:
1661: void __zend_mm_shutdown_canary(zend_mm_heap_canary *heap, int full_shutdown, int silent TSRMLS_DC)
1662: {
1663: zend_mm_storage *storage;
1664: zend_mm_segment *segment;
1665: zend_mm_segment *prev;
1666: int internal;
1667:
1668: if (heap->reserve) {
1669: #if ZEND_DEBUG
1670: if (!silent) {
1671: _zend_mm_free(heap, heap->reserve ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
1672: }
1673: #endif
1674: heap->reserve = NULL;
1675: }
1676:
1677: #if ZEND_MM_CACHE_STAT
1678: if (full_shutdown) {
1679: FILE *f;
1680:
1681: f = fopen("zend_mm.log", "w");
1682: if (f) {
1683: int i,j;
1684: size_t size, true_size, min_size, max_size;
1685: int hit = 0, miss = 0;
1686:
1687: fprintf(f, "\nidx min_size max_size true_size max_len hits misses\n");
1688: size = 0;
1689: while (1) {
1690: true_size = ZEND_MM_TRUE_SIZE(size);
1691: if (ZEND_MM_SMALL_SIZE(true_size)) {
1692: min_size = size;
1693: i = ZEND_MM_BUCKET_INDEX(true_size);
1694: size++;
1695: while (1) {
1696: true_size = ZEND_MM_TRUE_SIZE(size);
1697: if (ZEND_MM_SMALL_SIZE(true_size)) {
1698: j = ZEND_MM_BUCKET_INDEX(true_size);
1699: if (j > i) {
1700: max_size = size-1;
1701: break;
1702: }
1703: } else {
1704: max_size = size-1;
1705: break;
1706: }
1707: size++;
1708: }
1709: hit += heap->cache_stat[i].hit;
1710: miss += heap->cache_stat[i].miss;
1711: fprintf(f, "%2d %8d %8d %9d %8d %8d %8d\n", i, (int)min_size, (int)max_size, ZEND_MM_TRUE_SIZE(max_size), heap->cache_stat[i].max_count, heap->cache_stat[i].hit, heap->cache_stat[i].miss);
1712: } else {
1713: break;
1714: }
1715: }
1716: fprintf(f, " %8d %8d\n", hit, miss);
1717: fprintf(f, " %8d %8d\n", heap->cache_stat[ZEND_MM_NUM_BUCKETS].hit, heap->cache_stat[ZEND_MM_NUM_BUCKETS].miss);
1718: fclose(f);
1719: }
1720: }
1721: #endif
1722:
1723: #if ZEND_DEBUG
1724: if (!silent) {
1725: zend_mm_check_leaks(heap TSRMLS_CC);
1726: }
1727: #endif
1728:
1729: internal = heap->internal;
1730: storage = heap->storage;
1731: segment = heap->segments_list;
1732: while (segment) {
1733: prev = segment;
1734: segment = segment->next_segment;
1735: ZEND_MM_STORAGE_FREE(prev);
1736: }
1737: if (full_shutdown) {
1738: storage->handlers->dtor(storage);
1739: if (!internal) {
1740: free(heap);
1741: }
1742: } else {
1743: if (heap->compact_size &&
1744: heap->real_peak > heap->compact_size) {
1745: storage->handlers->compact(storage);
1746: }
1747: heap->segments_list = NULL;
1748: zend_mm_init(heap);
1749: heap->real_size = 0;
1750: heap->real_peak = 0;
1751: heap->size = 0;
1752: heap->peak = 0;
1753: if (heap->reserve_size) {
1754: heap->reserve = _zend_mm_alloc((zend_mm_heap *)heap, heap->reserve_size ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
1755: }
1756: heap->overflow = 0;
1757: }
1758: }
1759:
1760: static void zend_mm_safe_error(zend_mm_heap_canary *heap,
1761: const char *format,
1762: size_t limit,
1763: #if ZEND_DEBUG
1764: const char *filename,
1765: uint lineno,
1766: #endif
1767: size_t size)
1768: {
1769: if (heap->reserve) {
1770: _zend_mm_free_canary_int(heap, heap->reserve ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
1771: heap->reserve = NULL;
1772: }
1773: if (heap->overflow == 0) {
1774: char *error_filename;
1775: uint error_lineno;
1776: TSRMLS_FETCH();
1777: if (zend_is_compiling(TSRMLS_C)) {
1778: error_filename = zend_get_compiled_filename(TSRMLS_C);
1779: error_lineno = zend_get_compiled_lineno(TSRMLS_C);
1780: } else if (EG(in_execution)) {
1781: error_filename = EG(active_op_array)?EG(active_op_array)->filename:NULL;
1782: error_lineno = EG(opline_ptr)?(*EG(opline_ptr))->lineno:0;
1783: } else {
1784: error_filename = NULL;
1785: error_lineno = 0;
1786: }
1787: if (!error_filename) {
1788: error_filename = "Unknown";
1789: }
1790: heap->overflow = 1;
1791: zend_try {
1792: zend_error_noreturn(E_ERROR,
1793: format,
1794: limit,
1795: #if ZEND_DEBUG
1796: filename,
1797: lineno,
1798: #endif
1799: size);
1800: } zend_catch {
1801: if (heap->overflow == 2) {
1802: fprintf(stderr, "\nFatal error: ");
1803: fprintf(stderr,
1804: format,
1805: limit,
1806: #if ZEND_DEBUG
1807: filename,
1808: lineno,
1809: #endif
1810: size);
1811: fprintf(stderr, " in %s on line %d\n", error_filename, error_lineno);
1812: }
1813: /* See http://support.microsoft.com/kb/190351 */
1814: #ifdef PHP_WIN32
1815: fflush(stderr);
1816: #endif
1817: } zend_end_try();
1818: } else {
1819: heap->overflow = 2;
1820: }
1821: zend_bailout();
1822: }
1823:
1824: static zend_mm_free_block_canary *zend_mm_search_large_block(zend_mm_heap_canary *heap, size_t true_size)
1825: {
1826: zend_mm_free_block_canary *best_fit;
1827: size_t index = ZEND_MM_LARGE_BUCKET_INDEX(true_size);
1828: size_t bitmap = heap->large_free_bitmap >> index;
1829: zend_mm_free_block_canary *p;
1830:
1831: if (bitmap == 0) {
1832: return NULL;
1833: }
1834:
1835: if (UNEXPECTED((bitmap & 1) != 0)) {
1836: /* Search for best "large" free block */
1837: zend_mm_free_block_canary *rst = NULL;
1838: size_t m;
1839: size_t best_size = -1;
1840:
1841: best_fit = NULL;
1842: p = heap->large_free_buckets[index];
1843: for (m = true_size << (ZEND_MM_NUM_BUCKETS - index); ; m <<= 1) {
1844: if (UNEXPECTED(ZEND_MM_FREE_BLOCK_SIZE(p) == true_size)) {
1845: return SUHOSIN_MANGLE_PTR(p->next_free_block);
1846: } else if (ZEND_MM_FREE_BLOCK_SIZE(p) >= true_size &&
1847: ZEND_MM_FREE_BLOCK_SIZE(p) < best_size) {
1848: best_size = ZEND_MM_FREE_BLOCK_SIZE(p);
1849: best_fit = p;
1850: }
1851: if ((m & (ZEND_MM_LONG_CONST(1) << (ZEND_MM_NUM_BUCKETS-1))) == 0) {
1852: if (p->child[1]) {
1853: rst = p->child[1];
1854: }
1855: if (p->child[0]) {
1856: p = p->child[0];
1857: } else {
1858: break;
1859: }
1860: } else if (p->child[1]) {
1861: p = p->child[1];
1862: } else {
1863: break;
1864: }
1865: }
1866:
1867: for (p = rst; p; p = p->child[p->child[0] != NULL]) {
1868: if (UNEXPECTED(ZEND_MM_FREE_BLOCK_SIZE(p) == true_size)) {
1869: return SUHOSIN_MANGLE_PTR(p->next_free_block);
1870: } else if (ZEND_MM_FREE_BLOCK_SIZE(p) > true_size &&
1871: ZEND_MM_FREE_BLOCK_SIZE(p) < best_size) {
1872: best_size = ZEND_MM_FREE_BLOCK_SIZE(p);
1873: best_fit = p;
1874: }
1875: }
1876:
1877: if (best_fit) {
1878: return SUHOSIN_MANGLE_PTR(best_fit->next_free_block);
1879: }
1880: bitmap = bitmap >> 1;
1881: if (!bitmap) {
1882: return NULL;
1883: }
1884: index++;
1885: }
1886:
1887: /* Search for smallest "large" free block */
1888: best_fit = p = heap->large_free_buckets[index + zend_mm_low_bit(bitmap)];
1889: while ((p = p->child[p->child[0] != NULL])) {
1890: if (ZEND_MM_FREE_BLOCK_SIZE(p) < ZEND_MM_FREE_BLOCK_SIZE(best_fit)) {
1891: best_fit = p;
1892: }
1893: }
1894: return SUHOSIN_MANGLE_PTR(best_fit->next_free_block);
1895: }
1896:
1897: void *_zend_mm_alloc_canary_int(zend_mm_heap_canary *heap, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
1898: {
1899: zend_mm_free_block_canary *best_fit;
1900: size_t true_size = ZEND_MM_TRUE_SIZE(size);
1901: size_t block_size;
1902: size_t remaining_size;
1903: size_t segment_size;
1904: zend_mm_segment *segment;
1905: int keep_rest = 0;
1906:
1907: if (EXPECTED(ZEND_MM_SMALL_SIZE(true_size))) {
1908: size_t index = ZEND_MM_BUCKET_INDEX(true_size);
1909: size_t bitmap;
1910:
1911: if (UNEXPECTED(true_size < size)) {
1912: goto out_of_memory;
1913: }
1914: #if ZEND_MM_CACHE
1915: if (EXPECTED(heap->cache[index] != NULL)) {
1916: /* Get block from cache */
1917: #if ZEND_MM_CACHE_STAT
1918: heap->cache_stat[index].count--;
1919: heap->cache_stat[index].hit++;
1920: #endif
1921: best_fit = SUHOSIN_MANGLE_PTR(heap->cache[index]);
1922: heap->cache[index] = best_fit->prev_free_block;
1923: heap->cached -= true_size;
1924: #if SUHOSIN_PATCH
1925: SUHOSIN_MM_SET_CANARIES(best_fit);
1926: ((zend_mm_block_canary*)best_fit)->info.size = size;
1927: SUHOSIN_MM_SET_END_CANARY(best_fit);
1928: #endif
1929: ZEND_MM_CHECK_MAGIC(best_fit, MEM_BLOCK_CACHED);
1930: ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 0);
1931: return ZEND_MM_DATA_OF(best_fit);
1932: }
1933: #if ZEND_MM_CACHE_STAT
1934: heap->cache_stat[index].miss++;
1935: #endif
1936: #endif
1937:
1938: bitmap = heap->free_bitmap >> index;
1939: if (bitmap) {
1940: /* Found some "small" free block that can be used */
1941: index += zend_mm_low_bit(bitmap);
1942: best_fit = SUHOSIN_MANGLE_PTR(heap->free_buckets[index*2]);
1943: #if ZEND_MM_CACHE_STAT
1944: heap->cache_stat[ZEND_MM_NUM_BUCKETS].hit++;
1945: #endif
1946: goto zend_mm_finished_searching_for_block;
1947: }
1948: }
1949:
1950: #if ZEND_MM_CACHE_STAT
1951: heap->cache_stat[ZEND_MM_NUM_BUCKETS].miss++;
1952: #endif
1953:
1954: best_fit = zend_mm_search_large_block(heap, true_size);
1955:
1956: if (!best_fit && heap->real_size >= heap->limit - heap->block_size) {
1957: zend_mm_free_block_canary *p = SUHOSIN_MANGLE_PTR(heap->rest_buckets[0]);
1958: size_t best_size = -1;
1959:
1960: while (p != ZEND_MM_REST_BUCKET(heap)) {
1961: if (UNEXPECTED(ZEND_MM_FREE_BLOCK_SIZE(p) == true_size)) {
1962: best_fit = p;
1963: goto zend_mm_finished_searching_for_block;
1964: } else if (ZEND_MM_FREE_BLOCK_SIZE(p) > true_size &&
1965: ZEND_MM_FREE_BLOCK_SIZE(p) < best_size) {
1966: best_size = ZEND_MM_FREE_BLOCK_SIZE(p);
1967: best_fit = p;
1968: }
1969: p = SUHOSIN_MANGLE_PTR(p->prev_free_block);
1970: }
1971: }
1972:
1973: if (!best_fit) {
1974: if (true_size > heap->block_size - (ZEND_MM_ALIGNED_SEGMENT_SIZE + ZEND_MM_ALIGNED_HEADER_SIZE)) {
1975: /* Make sure we add a memory block which is big enough,
1976: segment must have header "size" and trailer "guard" block */
1977: segment_size = true_size + ZEND_MM_ALIGNED_SEGMENT_SIZE + ZEND_MM_ALIGNED_HEADER_SIZE;
1978: segment_size = (segment_size + (heap->block_size-1)) & ~(heap->block_size-1);
1979: keep_rest = 1;
1980: } else {
1981: segment_size = heap->block_size;
1982: }
1983:
1984: HANDLE_BLOCK_INTERRUPTIONS();
1985:
1986: if (segment_size < true_size ||
1987: heap->real_size + segment_size > heap->limit) {
1988: /* Memory limit overflow */
1989: #if ZEND_MM_CACHE
1990: zend_mm_free_cache(heap);
1991: #endif
1992: HANDLE_UNBLOCK_INTERRUPTIONS();
1993: #if ZEND_DEBUG
1994: zend_mm_safe_error(heap, "Allowed memory size of %ld bytes exhausted at %s:%d (tried to allocate %lu bytes)", heap->limit, __zend_filename, __zend_lineno, size);
1995: #else
1996: zend_mm_safe_error(heap, "Allowed memory size of %ld bytes exhausted (tried to allocate %lu bytes)", heap->limit, size);
1997: #endif
1998: }
1999:
2000: segment = (zend_mm_segment *) ZEND_MM_STORAGE_ALLOC(segment_size);
2001:
2002: if (!segment) {
2003: /* Storage manager cannot allocate memory */
2004: #if ZEND_MM_CACHE
2005: zend_mm_free_cache(heap);
2006: #endif
2007: HANDLE_UNBLOCK_INTERRUPTIONS();
2008: out_of_memory:
2009: #if ZEND_DEBUG
2010: zend_mm_safe_error(heap, "Out of memory (allocated %ld) at %s:%d (tried to allocate %lu bytes)", heap->real_size, __zend_filename, __zend_lineno, size);
2011: #else
2012: zend_mm_safe_error(heap, "Out of memory (allocated %ld) (tried to allocate %lu bytes)", heap->real_size, size);
2013: #endif
2014: return NULL;
2015: }
2016:
2017: heap->real_size += segment_size;
2018: if (heap->real_size > heap->real_peak) {
2019: heap->real_peak = heap->real_size;
2020: }
2021:
2022: segment->size = segment_size;
2023: segment->next_segment = heap->segments_list;
2024: heap->segments_list = segment;
2025:
2026: best_fit = (zend_mm_free_block_canary *) ((char *) segment + ZEND_MM_ALIGNED_SEGMENT_SIZE);
2027: ZEND_MM_MARK_FIRST_BLOCK(best_fit);
2028:
2029: block_size = segment_size - ZEND_MM_ALIGNED_SEGMENT_SIZE - ZEND_MM_ALIGNED_HEADER_SIZE;
2030:
2031: ZEND_MM_LAST_BLOCK(ZEND_MM_BLOCK_AT(best_fit, block_size));
2032:
2033: } else {
2034: zend_mm_finished_searching_for_block:
2035: /* remove from free list */
2036: HANDLE_BLOCK_INTERRUPTIONS();
2037: ZEND_MM_CHECK_MAGIC(best_fit, MEM_BLOCK_FREED);
2038: ZEND_MM_CHECK_COOKIE(best_fit);
2039: ZEND_MM_CHECK_BLOCK_LINKAGE(best_fit);
2040: zend_mm_remove_from_free_list(heap, best_fit);
2041:
2042: block_size = ZEND_MM_FREE_BLOCK_SIZE(best_fit);
2043: }
2044:
2045: remaining_size = block_size - true_size;
2046:
2047: if (remaining_size < ZEND_MM_ALIGNED_MIN_HEADER_SIZE) {
2048: true_size = block_size;
2049: ZEND_MM_BLOCK(best_fit, ZEND_MM_USED_BLOCK, true_size);
2050: } else {
2051: zend_mm_free_block_canary *new_free_block;
2052:
2053: /* prepare new free block */
2054: ZEND_MM_BLOCK(best_fit, ZEND_MM_USED_BLOCK, true_size);
2055: new_free_block = (zend_mm_free_block_canary *) ZEND_MM_BLOCK_AT(best_fit, true_size);
2056: ZEND_MM_BLOCK(new_free_block, ZEND_MM_FREE_BLOCK, remaining_size);
2057:
2058: /* add the new free block to the free list */
2059: if (EXPECTED(!keep_rest)) {
2060: zend_mm_add_to_free_list(heap, new_free_block);
2061: } else {
2062: zend_mm_add_to_rest_list(heap, new_free_block);
2063: }
2064: }
2065:
2066: ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 1);
2067:
2068: #if SUHOSIN_PATCH
2069: SUHOSIN_MM_SET_CANARIES(best_fit);
2070: ((zend_mm_block_canary*)best_fit)->info.size = size;
2071: SUHOSIN_MM_SET_END_CANARY(best_fit);
2072: #endif
2073:
2074: heap->size += true_size;
2075: if (heap->peak < heap->size) {
2076: heap->peak = heap->size;
2077: }
2078:
2079: HANDLE_UNBLOCK_INTERRUPTIONS();
2080: return ZEND_MM_DATA_OF(best_fit);
2081: }
2082:
2083:
2084: void _zend_mm_free_canary_int(zend_mm_heap_canary *heap, void *p ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
2085: {
2086: zend_mm_block_canary *mm_block;
2087: zend_mm_block_canary *next_block;
2088: size_t size;
2089:
2090: if (!ZEND_MM_VALID_PTR(p)) {
2091: return;
2092: }
2093:
2094: mm_block = ZEND_MM_HEADER_OF(p);
2095: size = ZEND_MM_BLOCK_SIZE(mm_block);
2096: #if SUHOSIN_PATCH
2097: SUHOSIN_MM_CHECK_CANARIES(mm_block, "efree()");
2098: #endif
2099: ZEND_MM_CHECK_PROTECTION(mm_block);
2100:
2101: #if ZEND_DEBUG || ZEND_MM_HEAP_PROTECTION
2102: memset(ZEND_MM_DATA_OF(mm_block), 0x5a, mm_block->debug.size);
2103: #endif
2104: #if SUHOSIN_PATCH
2105: if (UNEXPECTED(SUHOSIN_CONFIG(SUHOSIN_MM_DESTROY_FREE_MEMORY))) {
2106: memset(ZEND_MM_DATA_OF(mm_block), 0x5a, mm_block->info.size);
2107: }
2108: #endif
2109: #if ZEND_MM_CACHE
2110: if (EXPECTED(ZEND_MM_SMALL_SIZE(size)) && EXPECTED(heap->cached < ZEND_MM_CACHE_SIZE)) {
2111: size_t index = ZEND_MM_BUCKET_INDEX(size);
2112: zend_mm_free_block_canary **cache = &heap->cache[index];
2113:
2114: ((zend_mm_free_block_canary*)mm_block)->prev_free_block = *cache;
2115: *cache = (zend_mm_free_block_canary*)SUHOSIN_MANGLE_PTR(mm_block);
2116: heap->cached += size;
2117: ZEND_MM_SET_MAGIC(mm_block, MEM_BLOCK_CACHED);
2118: #if ZEND_MM_CACHE_STAT
2119: if (++heap->cache_stat[index].count > heap->cache_stat[index].max_count) {
2120: heap->cache_stat[index].max_count = heap->cache_stat[index].count;
2121: }
2122: #endif
2123: return;
2124: }
2125: #endif
2126:
2127: HANDLE_BLOCK_INTERRUPTIONS();
2128:
2129: heap->size -= size;
2130:
2131: next_block = ZEND_MM_BLOCK_AT(mm_block, size);
2132: if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
2133: zend_mm_remove_from_free_list(heap, (zend_mm_free_block_canary *) next_block);
2134: size += ZEND_MM_FREE_BLOCK_SIZE(next_block);
2135: }
2136: if (ZEND_MM_PREV_BLOCK_IS_FREE(mm_block)) {
2137: mm_block = ZEND_MM_PREV_BLOCK(mm_block);
2138: zend_mm_remove_from_free_list(heap, (zend_mm_free_block_canary *) mm_block);
2139: size += ZEND_MM_FREE_BLOCK_SIZE(mm_block);
2140: }
2141: if (ZEND_MM_IS_FIRST_BLOCK(mm_block) &&
2142: ZEND_MM_IS_GUARD_BLOCK(ZEND_MM_BLOCK_AT(mm_block, size))) {
2143: zend_mm_del_segment(heap, (zend_mm_segment *) ((char *)mm_block - ZEND_MM_ALIGNED_SEGMENT_SIZE));
2144: } else {
2145: ZEND_MM_BLOCK(mm_block, ZEND_MM_FREE_BLOCK, size);
2146: zend_mm_add_to_free_list(heap, (zend_mm_free_block_canary *) mm_block);
2147: }
2148: HANDLE_UNBLOCK_INTERRUPTIONS();
2149: }
2150:
2151: void *_zend_mm_realloc_canary_int(zend_mm_heap_canary *heap, void *p, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
2152: {
2153: zend_mm_block_canary *mm_block = ZEND_MM_HEADER_OF(p);
2154: zend_mm_block_canary *next_block;
2155: size_t true_size;
2156: size_t orig_size;
2157: void *ptr;
2158:
2159: if (UNEXPECTED(!p) || !ZEND_MM_VALID_PTR(p)) {
2160: return _zend_mm_alloc_canary_int(heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
2161: }
2162: mm_block = ZEND_MM_HEADER_OF(p);
2163: true_size = ZEND_MM_TRUE_SIZE(size);
2164: orig_size = ZEND_MM_BLOCK_SIZE(mm_block);
2165: #if SUHOSIN_PATCH
2166: SUHOSIN_MM_CHECK_CANARIES(mm_block, "erealloc()");
2167: #endif
2168: ZEND_MM_CHECK_PROTECTION(mm_block);
2169:
2170: if (UNEXPECTED(true_size < size)) {
2171: goto out_of_memory;
2172: }
2173:
2174: if (true_size <= orig_size) {
2175: size_t remaining_size = orig_size - true_size;
2176:
2177: if (remaining_size >= ZEND_MM_ALIGNED_MIN_HEADER_SIZE) {
2178: zend_mm_free_block_canary *new_free_block;
2179:
2180: HANDLE_BLOCK_INTERRUPTIONS();
2181: next_block = ZEND_MM_BLOCK_AT(mm_block, orig_size);
2182: if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
2183: remaining_size += ZEND_MM_FREE_BLOCK_SIZE(next_block);
2184: zend_mm_remove_from_free_list(heap, (zend_mm_free_block_canary *) next_block);
2185: }
2186:
2187: /* prepare new free block */
2188: ZEND_MM_BLOCK(mm_block, ZEND_MM_USED_BLOCK, true_size);
2189: new_free_block = (zend_mm_free_block_canary *) ZEND_MM_BLOCK_AT(mm_block, true_size);
2190:
2191: ZEND_MM_BLOCK(new_free_block, ZEND_MM_FREE_BLOCK, remaining_size);
2192:
2193: /* add the new free block to the free list */
2194: zend_mm_add_to_free_list(heap, new_free_block);
2195: heap->size += (true_size - orig_size);
2196: HANDLE_UNBLOCK_INTERRUPTIONS();
2197: }
2198: ZEND_MM_SET_DEBUG_INFO(mm_block, size, 0, 0);
2199: #if SUHOSIN_PATCH
2200: SUHOSIN_MM_SET_CANARIES(mm_block);
2201: ((zend_mm_block_canary*)mm_block)->info.size = size;
2202: SUHOSIN_MM_SET_END_CANARY(mm_block);
2203: #endif
2204: return p;
2205: }
2206:
2207: #if ZEND_MM_CACHE
2208: if (ZEND_MM_SMALL_SIZE(true_size)) {
2209: size_t index = ZEND_MM_BUCKET_INDEX(true_size);
2210:
2211: if (heap->cache[index] != NULL) {
2212: zend_mm_free_block_canary *best_fit;
2213: zend_mm_free_block_canary **cache;
2214:
2215: #if ZEND_MM_CACHE_STAT
2216: heap->cache_stat[index].count--;
2217: heap->cache_stat[index].hit++;
2218: #endif
2219: best_fit = SUHOSIN_MANGLE_PTR(heap->cache[index]);
2220: heap->cache[index] = best_fit->prev_free_block;
2221: ZEND_MM_CHECK_MAGIC(best_fit, MEM_BLOCK_CACHED);
2222: ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 0);
2223: #if SUHOSIN_PATCH
2224: SUHOSIN_MM_SET_CANARIES(best_fit);
2225: ((zend_mm_block_canary*)best_fit)->info.size = size;
2226: SUHOSIN_MM_SET_END_CANARY(best_fit);
2227: #endif
2228:
2229: ptr = ZEND_MM_DATA_OF(best_fit);
2230:
2231: #if ZEND_DEBUG || ZEND_MM_HEAP_PROTECTION
2232: memcpy(ptr, p, mm_block->debug.size);
2233: #else
2234: memcpy(ptr, p, orig_size - ZEND_MM_ALIGNED_HEADER_SIZE - CANARY_SIZE);
2235: #endif
2236:
2237: heap->cached -= true_size - orig_size;
2238:
2239: index = ZEND_MM_BUCKET_INDEX(orig_size);
2240: cache = &heap->cache[index];
2241:
2242: ((zend_mm_free_block_canary*)mm_block)->prev_free_block = *cache;
2243: *cache = (zend_mm_free_block_canary*)SUHOSIN_MANGLE_PTR(mm_block);
2244: ZEND_MM_SET_MAGIC(mm_block, MEM_BLOCK_CACHED);
2245: #if ZEND_MM_CACHE_STAT
2246: if (++heap->cache_stat[index].count > heap->cache_stat[index].max_count) {
2247: heap->cache_stat[index].max_count = heap->cache_stat[index].count;
2248: }
2249: #endif
2250: return ptr;
2251: }
2252: }
2253: #endif
2254:
2255: next_block = ZEND_MM_BLOCK_AT(mm_block, orig_size);
2256:
2257: if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
2258: ZEND_MM_CHECK_COOKIE(next_block);
2259: ZEND_MM_CHECK_BLOCK_LINKAGE(next_block);
2260: if (orig_size + ZEND_MM_FREE_BLOCK_SIZE(next_block) >= true_size) {
2261: size_t block_size = orig_size + ZEND_MM_FREE_BLOCK_SIZE(next_block);
2262: size_t remaining_size = block_size - true_size;
2263:
2264: HANDLE_BLOCK_INTERRUPTIONS();
2265: zend_mm_remove_from_free_list(heap, (zend_mm_free_block_canary *) next_block);
2266:
2267: if (remaining_size < ZEND_MM_ALIGNED_MIN_HEADER_SIZE) {
2268: true_size = block_size;
2269: ZEND_MM_BLOCK(mm_block, ZEND_MM_USED_BLOCK, true_size);
2270: } else {
2271: zend_mm_free_block_canary *new_free_block;
2272:
2273: /* prepare new free block */
2274: ZEND_MM_BLOCK(mm_block, ZEND_MM_USED_BLOCK, true_size);
2275: new_free_block = (zend_mm_free_block_canary *) ZEND_MM_BLOCK_AT(mm_block, true_size);
2276: ZEND_MM_BLOCK(new_free_block, ZEND_MM_FREE_BLOCK, remaining_size);
2277:
2278: /* add the new free block to the free list */
2279: if (ZEND_MM_IS_FIRST_BLOCK(mm_block) &&
2280: ZEND_MM_IS_GUARD_BLOCK(ZEND_MM_BLOCK_AT(new_free_block, remaining_size))) {
2281: zend_mm_add_to_rest_list(heap, new_free_block);
2282: } else {
2283: zend_mm_add_to_free_list(heap, new_free_block);
2284: }
2285: }
2286: ZEND_MM_SET_DEBUG_INFO(mm_block, size, 0, 0);
2287: heap->size = heap->size + true_size - orig_size;
2288: if (heap->peak < heap->size) {
2289: heap->peak = heap->size;
2290: }
2291: HANDLE_UNBLOCK_INTERRUPTIONS();
2292: #if SUHOSIN_PATCH
2293: SUHOSIN_MM_SET_CANARIES(mm_block);
2294: ((zend_mm_block_canary*)mm_block)->info.size = size;
2295: SUHOSIN_MM_SET_END_CANARY(mm_block);
2296: #endif
2297: return p;
2298: } else if (ZEND_MM_IS_FIRST_BLOCK(mm_block) &&
2299: ZEND_MM_IS_GUARD_BLOCK(ZEND_MM_BLOCK_AT(next_block, ZEND_MM_FREE_BLOCK_SIZE(next_block)))) {
2300: HANDLE_BLOCK_INTERRUPTIONS();
2301: zend_mm_remove_from_free_list(heap, (zend_mm_free_block_canary *) next_block);
2302: goto realloc_segment;
2303: }
2304: } else if (ZEND_MM_IS_FIRST_BLOCK(mm_block) && ZEND_MM_IS_GUARD_BLOCK(next_block)) {
2305: zend_mm_segment *segment;
2306: zend_mm_segment *segment_copy;
2307: size_t segment_size;
2308: size_t block_size;
2309: size_t remaining_size;
2310:
2311: HANDLE_BLOCK_INTERRUPTIONS();
2312: realloc_segment:
2313: /* segment size, size of block and size of guard block */
2314: if (true_size > heap->block_size - (ZEND_MM_ALIGNED_SEGMENT_SIZE + ZEND_MM_ALIGNED_HEADER_SIZE)) {
2315: segment_size = true_size+ZEND_MM_ALIGNED_SEGMENT_SIZE+ZEND_MM_ALIGNED_HEADER_SIZE;
2316: segment_size = (segment_size + (heap->block_size-1)) & ~(heap->block_size-1);
2317: } else {
2318: segment_size = heap->block_size;
2319: }
2320:
2321: segment_copy = (zend_mm_segment *) ((char *)mm_block - ZEND_MM_ALIGNED_SEGMENT_SIZE);
2322: if (segment_size < true_size ||
2323: heap->real_size + segment_size - segment_copy->size > heap->limit) {
2324: if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
2325: zend_mm_add_to_free_list(heap, (zend_mm_free_block_canary *) next_block);
2326: }
2327: #if ZEND_MM_CACHE
2328: zend_mm_free_cache(heap);
2329: #endif
2330: HANDLE_UNBLOCK_INTERRUPTIONS();
2331: #if ZEND_DEBUG
2332: zend_mm_safe_error(heap, "Allowed memory size of %ld bytes exhausted at %s:%d (tried to allocate %ld bytes)", heap->limit, __zend_filename, __zend_lineno, size);
2333: #else
2334: zend_mm_safe_error(heap, "Allowed memory size of %ld bytes exhausted (tried to allocate %ld bytes)", heap->limit, size);
2335: #endif
2336: return NULL;
2337: }
2338:
2339: segment = ZEND_MM_STORAGE_REALLOC(segment_copy, segment_size);
2340: if (!segment) {
2341: #if ZEND_MM_CACHE
2342: zend_mm_free_cache(heap);
2343: #endif
2344: HANDLE_UNBLOCK_INTERRUPTIONS();
2345: out_of_memory:
2346: #if ZEND_DEBUG
2347: zend_mm_safe_error(heap, "Out of memory (allocated %ld) at %s:%d (tried to allocate %ld bytes)", heap->real_size, __zend_filename, __zend_lineno, size);
2348: #else
2349: zend_mm_safe_error(heap, "Out of memory (allocated %ld) (tried to allocate %ld bytes)", heap->real_size, size);
2350: #endif
2351: return NULL;
2352: }
2353: heap->real_size += segment_size - segment->size;
2354: if (heap->real_size > heap->real_peak) {
2355: heap->real_peak = heap->real_size;
2356: }
2357:
2358: segment->size = segment_size;
2359:
2360: if (segment != segment_copy) {
2361: zend_mm_segment **seg = &heap->segments_list;
2362: while (*seg != segment_copy) {
2363: seg = &(*seg)->next_segment;
2364: }
2365: *seg = segment;
2366: mm_block = (zend_mm_block_canary *) ((char *) segment + ZEND_MM_ALIGNED_SEGMENT_SIZE);
2367: ZEND_MM_MARK_FIRST_BLOCK(mm_block);
2368: }
2369:
2370: block_size = segment_size - ZEND_MM_ALIGNED_SEGMENT_SIZE - ZEND_MM_ALIGNED_HEADER_SIZE;
2371: remaining_size = block_size - true_size;
2372:
2373: /* setup guard block */
2374: ZEND_MM_LAST_BLOCK(ZEND_MM_BLOCK_AT(mm_block, block_size));
2375:
2376: if (remaining_size < ZEND_MM_ALIGNED_MIN_HEADER_SIZE) {
2377: true_size = block_size;
2378: ZEND_MM_BLOCK(mm_block, ZEND_MM_USED_BLOCK, true_size);
2379: } else {
2380: zend_mm_free_block_canary *new_free_block;
2381:
2382: /* prepare new free block */
2383: ZEND_MM_BLOCK(mm_block, ZEND_MM_USED_BLOCK, true_size);
2384: new_free_block = (zend_mm_free_block_canary *) ZEND_MM_BLOCK_AT(mm_block, true_size);
2385: ZEND_MM_BLOCK(new_free_block, ZEND_MM_FREE_BLOCK, remaining_size);
2386:
2387: /* add the new free block to the free list */
2388: zend_mm_add_to_rest_list(heap, new_free_block);
2389: }
2390:
2391: ZEND_MM_SET_DEBUG_INFO(mm_block, size, 1, 1);
2392:
2393: heap->size = heap->size + true_size - orig_size;
2394: if (heap->peak < heap->size) {
2395: heap->peak = heap->size;
2396: }
2397:
2398: HANDLE_UNBLOCK_INTERRUPTIONS();
2399: #if SUHOSIN_PATCH
2400: SUHOSIN_MM_SET_CANARIES(mm_block);
2401: ((zend_mm_block_canary*)mm_block)->info.size = size;
2402: SUHOSIN_MM_SET_END_CANARY(mm_block);
2403: #endif
2404: return ZEND_MM_DATA_OF(mm_block);
2405: }
2406:
2407: ptr = _zend_mm_alloc_canary_int(heap, size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
2408: #if ZEND_DEBUG || ZEND_MM_HEAP_PROTECTION
2409: memcpy(ptr, p, mm_block->debug.size);
2410: #else
2411: memcpy(ptr, p, orig_size - ZEND_MM_ALIGNED_HEADER_SIZE - CANARY_SIZE);
2412: #endif
2413: _zend_mm_free_canary_int(heap, p ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
2414: return ptr;
2415: }
2416:
2417: ZEND_API size_t _zend_mm_block_size_canary(zend_mm_heap_canary *heap, void *p ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
2418: {
2419: zend_mm_block_canary *mm_block;
2420:
2421: if (!ZEND_MM_VALID_PTR(p)) {
2422: return 0;
2423: }
2424: mm_block = ZEND_MM_HEADER_OF(p);
2425: ZEND_MM_CHECK_PROTECTION(mm_block);
2426: #if ZEND_DEBUG || ZEND_MM_HEAP_PROTECTION
2427: return mm_block->debug.size;
2428: #else
2429: return ZEND_MM_BLOCK_SIZE(mm_block);
2430: #endif
2431: }
2432:
2433: #if defined(__GNUC__) && defined(i386)
2434:
2435: static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
2436: {
2437: size_t res = nmemb;
2438: unsigned long overflow = 0;
2439:
2440: __asm__ ("mull %3\n\taddl %4,%0\n\tadcl %1,%1"
2441: : "=&a"(res), "=&d" (overflow)
2442: : "%0"(res),
2443: "rm"(size),
2444: "rm"(offset));
2445:
2446: if (UNEXPECTED(overflow)) {
2447: zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
2448: return 0;
2449: }
2450: return res;
2451: }
2452:
2453: #elif defined(__GNUC__) && defined(__x86_64__)
2454:
2455: static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
2456: {
2457: size_t res = nmemb;
2458: unsigned long overflow = 0;
2459:
2460: __asm__ ("mulq %3\n\taddq %4,%0\n\tadcq %1,%1"
2461: : "=&a"(res), "=&d" (overflow)
2462: : "%0"(res),
2463: "rm"(size),
2464: "rm"(offset));
2465:
2466: if (UNEXPECTED(overflow)) {
2467: zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
2468: return 0;
2469: }
2470: return res;
2471: }
2472:
2473: #elif SIZEOF_SIZE_T == 4 && defined(HAVE_ZEND_LONG64)
2474:
2475: static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
2476: {
2477: zend_ulong64 res = (zend_ulong64)nmemb * (zend_ulong64)size + (zend_ulong64)offset;
2478:
2479: if (UNEXPECTED(res > (zend_ulong64)0xFFFFFFFFL)) {
2480: zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
2481: return 0;
2482: }
2483: return (size_t) res;
2484: }
2485:
2486: #else
2487:
2488: static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
2489: {
2490: size_t res = nmemb * size + offset;
2491: double _d = (double)nmemb * (double)size + (double)offset;
2492: double _delta = (double)res - _d;
2493:
2494: if (UNEXPECTED((_d + _delta ) != _d)) {
2495: zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
2496: return 0;
2497: }
2498: return res;
2499: }
2500: #endif
2501:
2502: /*
2503: * Local variables:
2504: * tab-width: 4
2505: * c-basic-offset: 4
2506: * indent-tabs-mode: t
2507: * End:
2508: */
2509:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to zend_alloc_canary.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / php / Zend