Skip to content

Commit 9981bad

Browse files
committed
Add a test
1 parent 5474107 commit 9981bad

File tree

1 file changed

+42
-0
lines changed

1 file changed

+42
-0
lines changed

src/test/func/memory/memory.cc

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -515,6 +515,47 @@ void test_consolidaton_bug()
515515
}
516516
}
517517

518+
/**
519+
* Test that scrub free does not allow a secret to leak to the
520+
* next allocation.
521+
*/
522+
void test_scrub_free()
523+
{
524+
if (!snmalloc::mitigations(snmalloc::scrub_free))
525+
return;
526+
527+
auto& alloc = ThreadAlloc::get();
528+
529+
auto secret = (char*)alloc.alloc(256);
530+
strcpy(secret, "mypassword");
531+
532+
auto leak = (void**)alloc.alloc(16 * sizeof(void*));
533+
534+
for (size_t i = 0; i < 16; i++)
535+
{
536+
leak[i] = secret;
537+
}
538+
539+
alloc.dealloc(leak);
540+
541+
for (size_t i = 0; i < 10000; i++)
542+
{
543+
auto search = (char**)alloc.alloc(16 * sizeof(void*));
544+
545+
for (size_t j = 0; j < 16; j++)
546+
{
547+
if (search[j] == secret)
548+
{
549+
printf(
550+
"Secret \"%s\" after %zu index %zu @%p\n", search[j], i, j, search);
551+
SNMALLOC_CHECK(false);
552+
}
553+
}
554+
555+
alloc.dealloc(search);
556+
}
557+
}
558+
518559
int main(int argc, char** argv)
519560
{
520561
setup();
@@ -555,5 +596,6 @@ int main(int argc, char** argv)
555596
test_calloc_16M();
556597
#endif
557598
test_consolidaton_bug();
599+
test_scrub_free();
558600
return 0;
559601
}

0 commit comments

Comments
 (0)