Skip to content

Commit 7eac4bf

Browse files
committed
Add a test
1 parent 5474107 commit 7eac4bf

File tree

1 file changed

+41
-0
lines changed

1 file changed

+41
-0
lines changed

src/test/func/memory/memory.cc

+41
Original file line numberDiff line numberDiff line change
@@ -515,6 +515,46 @@ void test_consolidaton_bug()
515515
}
516516
}
517517

518+
/**
519+
* Test that scrub free does not allow a secret to leak to the
520+
* next allocation.
521+
*/
522+
void test_scrub_free()
523+
{
524+
if (!snmalloc::mitigations(snmalloc::scrub_free))
525+
return;
526+
527+
auto& alloc = ThreadAlloc::get();
528+
529+
auto secret = (char*)alloc.alloc(256);
530+
strcpy(secret, "mypassword");
531+
532+
auto leak = (void**)alloc.alloc(16 * sizeof(void*));
533+
534+
for (size_t i = 0; i < 16; i++)
535+
{
536+
leak[i] = secret;
537+
}
538+
539+
alloc.dealloc(leak);
540+
541+
for (size_t i = 0; i < 10000; i++)
542+
{
543+
auto search = (char**)alloc.alloc(16 * sizeof(void*));
544+
545+
for (size_t j = 0; j < 16; j++)
546+
{
547+
if (search[j] == secret)
548+
{
549+
printf("Secret \"%s\" after %zu index %zu @%p\n", search[j], i, j, search);
550+
SNMALLOC_CHECK(false);
551+
}
552+
}
553+
554+
alloc.dealloc(search);
555+
}
556+
}
557+
518558
int main(int argc, char** argv)
519559
{
520560
setup();
@@ -555,5 +595,6 @@ int main(int argc, char** argv)
555595
test_calloc_16M();
556596
#endif
557597
test_consolidaton_bug();
598+
test_scrub_free();
558599
return 0;
559600
}

0 commit comments

Comments
 (0)