1//===-- asan_malloc_win.cpp -----------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file is a part of AddressSanitizer, an address sanity checker.
10//
11// Windows-specific malloc interception.
12//===----------------------------------------------------------------------===//
13
14#include "sanitizer_common/sanitizer_allocator_interface.h"
15#include "sanitizer_common/sanitizer_platform.h"
16#if SANITIZER_WINDOWS
17# include <stddef.h>
18
19# include "asan_allocator.h"
20# include "asan_interceptors.h"
21# include "asan_internal.h"
22# include "asan_stack.h"
23# include "interception/interception.h"
24# include "sanitizer_common/sanitizer_win_defs.h"
25
26// Intentionally not including windows.h here, to avoid the risk of
27// pulling in conflicting declarations of these functions. (With mingw-w64,
28// there's a risk of windows.h pulling in stdint.h.)
29typedef int BOOL;
30typedef void *HANDLE;
31typedef const void *LPCVOID;
32typedef void *LPVOID;
33
34typedef unsigned long DWORD;
35constexpr unsigned long HEAP_ZERO_MEMORY = 0x00000008;
36constexpr unsigned long HEAP_REALLOC_IN_PLACE_ONLY = 0x00000010;
37constexpr unsigned long HEAP_ALLOCATE_SUPPORTED_FLAGS = (HEAP_ZERO_MEMORY);
38constexpr unsigned long HEAP_ALLOCATE_UNSUPPORTED_FLAGS =
39 (~HEAP_ALLOCATE_SUPPORTED_FLAGS);
40constexpr unsigned long HEAP_FREE_UNSUPPORTED_FLAGS =
41 (~HEAP_ALLOCATE_SUPPORTED_FLAGS);
42constexpr unsigned long HEAP_REALLOC_UNSUPPORTED_FLAGS =
43 (~HEAP_ALLOCATE_SUPPORTED_FLAGS);
44
45
46extern "C" {
47LPVOID WINAPI HeapAlloc(HANDLE hHeap, DWORD dwFlags, size_t dwBytes);
48LPVOID WINAPI HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem,
49 size_t dwBytes);
50BOOL WINAPI HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem);
51size_t WINAPI HeapSize(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem);
52
53BOOL WINAPI HeapValidate(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem);
54}
55
56using namespace __asan;
57
58// Marks an allocation as originally zero-size. Must be called on allocations
59// that were changed from size 0 to 1 outside of Allocate() (e.g.
60// SharedReAlloc).
61namespace __asan {
62void asan_mark_zero_allocation(void* ptr);
63}
64
65// MT: Simply defining functions with the same signature in *.obj
66// files overrides the standard functions in the CRT.
67// MD: Memory allocation functions are defined in the CRT .dll,
68// so we have to intercept them before they are called for the first time.
69
70extern "C" {
71__declspec(noinline) size_t _msize(void *ptr) {
72 GET_CURRENT_PC_BP_SP;
73 (void)sp;
74 return asan_malloc_usable_size(ptr, pc, bp);
75}
76
77__declspec(noinline) size_t _msize_base(void *ptr) { return _msize(ptr); }
78
79__declspec(noinline) void free(void *ptr) {
80 GET_STACK_TRACE_FREE;
81 return asan_free(ptr, &stack);
82}
83
84__declspec(noinline) void _free_dbg(void *ptr, int) { free(ptr); }
85
86__declspec(noinline) void _free_base(void *ptr) { free(ptr); }
87
88__declspec(noinline) void *malloc(size_t size) {
89 GET_STACK_TRACE_MALLOC;
90 return asan_malloc(size, &stack);
91}
92
93__declspec(noinline) void *_malloc_base(size_t size) { return malloc(size); }
94
95__declspec(noinline) void *_malloc_dbg(size_t size, int, const char *, int) {
96 return malloc(size);
97}
98
99__declspec(noinline) void *calloc(size_t nmemb, size_t size) {
100 GET_STACK_TRACE_MALLOC;
101 return asan_calloc(nmemb, size, &stack);
102}
103
104__declspec(noinline) void *_calloc_base(size_t nmemb, size_t size) {
105 return calloc(nmemb, size);
106}
107
108__declspec(noinline) void *_calloc_dbg(size_t nmemb, size_t size, int,
109 const char *, int) {
110 return calloc(nmemb, size);
111}
112
113__declspec(noinline) void *_calloc_impl(size_t nmemb, size_t size,
114 int *errno_tmp) {
115 return calloc(nmemb, size);
116}
117
118__declspec(noinline) void *realloc(void *ptr, size_t size) {
119 GET_STACK_TRACE_MALLOC;
120 return asan_realloc(ptr, size, &stack);
121}
122
123__declspec(noinline) void *_realloc_dbg(void *ptr, size_t size, int) {
124 UNREACHABLE("_realloc_dbg should not exist!");
125 return 0;
126}
127
128__declspec(noinline) void *_realloc_base(void *ptr, size_t size) {
129 return realloc(ptr, size);
130}
131
132__declspec(noinline) void *_recalloc(void *p, size_t n, size_t elem_size) {
133 if (!p)
134 return calloc(n, elem_size);
135 const size_t size = n * elem_size;
136 if (elem_size != 0 && size / elem_size != n)
137 return 0;
138
139 size_t old_size = _msize(p);
140 void *new_alloc = malloc(size);
141 if (new_alloc) {
142 REAL(memcpy)(new_alloc, p, Min<size_t>(size, old_size));
143 if (old_size < size)
144 REAL(memset)(((u8 *)new_alloc) + old_size, 0, size - old_size);
145 free(p);
146 }
147 return new_alloc;
148}
149
150__declspec(noinline) void *_recalloc_base(void *p, size_t n, size_t elem_size) {
151 return _recalloc(p, n, elem_size);
152}
153
154__declspec(noinline) void *_expand(void *memblock, size_t size) {
155 // _expand is used in realloc-like functions to resize the buffer if possible.
156 // We don't want memory to stand still while resizing buffers, so return 0.
157 return 0;
158}
159
160__declspec(noinline) void *_expand_dbg(void *memblock, size_t size) {
161 return _expand(memblock, size);
162}
163
164__declspec(dllexport) size_t __cdecl __asan_msize(void *ptr) {
165 return _msize(ptr);
166}
167__declspec(dllexport) void __cdecl __asan_free(void *const ptr) { free(ptr); }
168__declspec(dllexport) void *__cdecl __asan_malloc(const size_t size) {
169 return malloc(size);
170}
171__declspec(dllexport) void *__cdecl __asan_calloc(const size_t nmemb,
172 const size_t size) {
173 return calloc(nmemb, size);
174}
175__declspec(dllexport) void *__cdecl __asan_realloc(void *const ptr,
176 const size_t size) {
177 return realloc(ptr, size);
178}
179__declspec(dllexport) void *__cdecl __asan_recalloc(void *const ptr,
180 const size_t nmemb,
181 const size_t size) {
182 return _recalloc(ptr, nmemb, size);
183}
184
185// TODO(timurrrr): Might want to add support for _aligned_* allocation
186// functions to detect a bit more bugs. Those functions seem to wrap malloc().
187
188int _CrtDbgReport(int, const char*, int,
189 const char*, const char*, ...) {
190 ShowStatsAndAbort();
191}
192
193int _CrtDbgReportW(int reportType, const wchar_t*, int,
194 const wchar_t*, const wchar_t*, ...) {
195 ShowStatsAndAbort();
196}
197
198int _CrtSetReportMode(int, int) {
199 return 0;
200}
201} // extern "C"
202
203#define OWNED_BY_RTL(heap, memory) \
204 (!__sanitizer_get_ownership(memory) && HeapValidate(heap, 0, memory))
205
206INTERCEPTOR_WINAPI(size_t, HeapSize, HANDLE hHeap, DWORD dwFlags,
207 LPCVOID lpMem) {
208 // If the RTL allocators are hooked we need to check whether the ASAN
209 // allocator owns the pointer we're about to use. Allocations occur before
210 // interception takes place, so if it is not owned by the RTL heap we can
211 // pass it to the ASAN heap for inspection.
212 if (flags()->windows_hook_rtl_allocators) {
213 if (!AsanInited() || OWNED_BY_RTL(hHeap, lpMem))
214 return REAL(HeapSize)(hHeap, dwFlags, lpMem);
215 } else {
216 CHECK(dwFlags == 0 && "unsupported heap flags");
217 }
218 GET_CURRENT_PC_BP_SP;
219 (void)sp;
220 return asan_malloc_usable_size(lpMem, pc, bp);
221}
222
223INTERCEPTOR_WINAPI(LPVOID, HeapAlloc, HANDLE hHeap, DWORD dwFlags,
224 size_t dwBytes) {
225 // If the ASAN runtime is not initialized, or we encounter an unsupported
226 // flag, fall back to the original allocator.
227 if (flags()->windows_hook_rtl_allocators) {
228 if (UNLIKELY(!AsanInited() ||
229 (dwFlags & HEAP_ALLOCATE_UNSUPPORTED_FLAGS) != 0)) {
230 return REAL(HeapAlloc)(hHeap, dwFlags, dwBytes);
231 }
232 } else {
233 // In the case that we don't hook the rtl allocators,
234 // this becomes an assert since there is no failover to the original
235 // allocator.
236 CHECK((HEAP_ALLOCATE_UNSUPPORTED_FLAGS & dwFlags) != 0 &&
237 "unsupported flags");
238 }
239 GET_STACK_TRACE_MALLOC;
240 void *p = asan_malloc(dwBytes, &stack);
241 // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
242 // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
243 // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
244 if (p && (dwFlags & HEAP_ZERO_MEMORY)) {
245 GET_CURRENT_PC_BP_SP;
246 (void)sp;
247 auto usable_size = asan_malloc_usable_size(p, pc, bp);
248 internal_memset(p, 0, usable_size);
249 }
250 return p;
251}
252
253INTERCEPTOR_WINAPI(BOOL, HeapFree, HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) {
254 // Heap allocations happen before this function is hooked, so we must fall
255 // back to the original function if the pointer is not from the ASAN heap,
256 // or unsupported flags are provided.
257 if (flags()->windows_hook_rtl_allocators) {
258 if (OWNED_BY_RTL(hHeap, lpMem))
259 return REAL(HeapFree)(hHeap, dwFlags, lpMem);
260 } else {
261 CHECK((HEAP_FREE_UNSUPPORTED_FLAGS & dwFlags) != 0 && "unsupported flags");
262 }
263 GET_STACK_TRACE_FREE;
264 asan_free(lpMem, &stack);
265 return true;
266}
267
268namespace __asan {
269using AllocFunction = LPVOID(WINAPI *)(HANDLE, DWORD, size_t);
270using ReAllocFunction = LPVOID(WINAPI *)(HANDLE, DWORD, LPVOID, size_t);
271using SizeFunction = size_t(WINAPI *)(HANDLE, DWORD, LPVOID);
272using FreeFunction = BOOL(WINAPI *)(HANDLE, DWORD, LPVOID);
273
274void *SharedReAlloc(ReAllocFunction reallocFunc, SizeFunction heapSizeFunc,
275 FreeFunction freeFunc, AllocFunction allocFunc,
276 HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, size_t dwBytes) {
277 CHECK(reallocFunc && heapSizeFunc && freeFunc && allocFunc);
278 GET_STACK_TRACE_MALLOC;
279 GET_CURRENT_PC_BP_SP;
280 (void)sp;
281 if (flags()->windows_hook_rtl_allocators) {
282 enum AllocationOwnership { NEITHER = 0, ASAN = 1, RTL = 2 };
283 AllocationOwnership ownershipState;
284 bool owned_rtlalloc = false;
285 bool owned_asan = __sanitizer_get_ownership(lpMem);
286
287 if (!owned_asan)
288 owned_rtlalloc = HeapValidate(hHeap, 0, lpMem);
289
290 if (owned_asan && !owned_rtlalloc)
291 ownershipState = ASAN;
292 else if (!owned_asan && owned_rtlalloc)
293 ownershipState = RTL;
294 else if (!owned_asan && !owned_rtlalloc)
295 ownershipState = NEITHER;
296
297 // If this heap block which was allocated before the ASAN
298 // runtime came up, use the real HeapFree function.
299 if (UNLIKELY(!AsanInited())) {
300 return reallocFunc(hHeap, dwFlags, lpMem, dwBytes);
301 }
302 bool only_asan_supported_flags =
303 (HEAP_REALLOC_UNSUPPORTED_FLAGS & dwFlags) == 0;
304
305 if (ownershipState == RTL ||
306 (ownershipState == NEITHER && !only_asan_supported_flags)) {
307 if (only_asan_supported_flags) {
308 // if this is a conversion to ASAN upported flags, transfer this
309 // allocation to the ASAN allocator
310 void *replacement_alloc;
311 if (dwFlags & HEAP_ZERO_MEMORY)
312 replacement_alloc = asan_calloc(1, dwBytes, &stack);
313 else
314 replacement_alloc = asan_malloc(dwBytes, &stack);
315 if (replacement_alloc) {
316 size_t old_size = heapSizeFunc(hHeap, dwFlags, lpMem);
317 if (old_size == ((size_t)0) - 1) {
318 asan_free(replacement_alloc, &stack);
319 return nullptr;
320 }
321 REAL(memcpy)(replacement_alloc, lpMem, old_size);
322 freeFunc(hHeap, dwFlags, lpMem);
323 }
324 return replacement_alloc;
325 } else {
326 // owned by rtl or neither with unsupported ASAN flags,
327 // just pass back to original allocator
328 CHECK(ownershipState == RTL || ownershipState == NEITHER);
329 CHECK(!only_asan_supported_flags);
330 return reallocFunc(hHeap, dwFlags, lpMem, dwBytes);
331 }
332 }
333
334 if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY) {
335 size_t old_usable_size = asan_malloc_usable_size(lpMem, pc, bp);
336 if (dwBytes == old_usable_size) {
337 // Nothing to change, return the current pointer.
338 return lpMem;
339 } else if (dwBytes >= old_usable_size) {
340 // Growing with HEAP_REALLOC_IN_PLACE_ONLY is not supported.
341 return nullptr;
342 } else {
343 // Shrinking with HEAP_REALLOC_IN_PLACE_ONLY is not yet supported.
344 // For now return the current pointer and
345 // leave the allocation size as it is.
346 return lpMem;
347 }
348 }
349
350 if (ownershipState == ASAN && !only_asan_supported_flags) {
351 // Conversion to unsupported flags allocation,
352 // transfer this allocation back to the original allocator.
353 void *replacement_alloc = allocFunc(hHeap, dwFlags, dwBytes);
354 size_t old_usable_size = 0;
355 if (replacement_alloc) {
356 old_usable_size = asan_malloc_usable_size(lpMem, pc, bp);
357 REAL(memcpy)(replacement_alloc, lpMem,
358 Min<size_t>(dwBytes, old_usable_size));
359 asan_free(lpMem, &stack);
360 }
361 return replacement_alloc;
362 }
363
364 CHECK((ownershipState == ASAN || ownershipState == NEITHER) &&
365 only_asan_supported_flags);
366 // At this point we should either be ASAN owned with ASAN supported flags
367 // or we owned by neither and have supported flags.
368 // Pass through even when it's neither since this could be a null realloc or
369 // UAF that ASAN needs to catch.
370 } else {
371 CHECK((HEAP_REALLOC_UNSUPPORTED_FLAGS & dwFlags) != 0 &&
372 "unsupported flags");
373 }
374 // asan_realloc will never reallocate in place, so for now this flag is
375 // unsupported until we figure out a way to fake this.
376 if (dwFlags & HEAP_REALLOC_IN_PLACE_ONLY)
377 return nullptr;
378
379 // HeapReAlloc and HeapAlloc both happily accept 0 sized allocations.
380 // passing a 0 size into asan_realloc will free the allocation.
381 // To avoid this and keep behavior consistent, fudge the size if 0.
382 // (asan_malloc already does this)
383 bool was_zero_size = (dwBytes == 0);
384 if (was_zero_size)
385 dwBytes = 1;
386
387 size_t old_size;
388 if (dwFlags & HEAP_ZERO_MEMORY)
389 old_size = asan_malloc_usable_size(lpMem, pc, bp);
390
391 void *ptr = asan_realloc(lpMem, dwBytes, &stack);
392 if (ptr == nullptr)
393 return nullptr;
394
395 if (was_zero_size)
396 asan_mark_zero_allocation(ptr);
397
398 if (dwFlags & HEAP_ZERO_MEMORY) {
399 size_t new_size = asan_malloc_usable_size(ptr, pc, bp);
400 if (old_size < new_size)
401 REAL(memset)(((u8 *)ptr) + old_size, 0, new_size - old_size);
402 }
403
404 return ptr;
405}
406} // namespace __asan
407
408INTERCEPTOR_WINAPI(LPVOID, HeapReAlloc, HANDLE hHeap, DWORD dwFlags,
409 LPVOID lpMem, size_t dwBytes) {
410 return SharedReAlloc(REAL(HeapReAlloc), (SizeFunction)REAL(HeapSize),
411 REAL(HeapFree), REAL(HeapAlloc), hHeap, dwFlags, lpMem,
412 dwBytes);
413}
414
415// The following functions are undocumented and subject to change.
416// However, hooking them is necessary to hook Windows heap
417// allocations with detours and their definitions are unlikely to change.
418// Comments in /minkernel/ntos/rtl/heappublic.c indicate that these functions
419// are part of the heap's public interface.
420typedef unsigned long LOGICAL;
421
422// This function is documented as part of the Driver Development Kit but *not*
423// the Windows Development Kit.
424LOGICAL RtlFreeHeap(void* HeapHandle, DWORD Flags,
425 void* BaseAddress);
426
427// This function is documented as part of the Driver Development Kit but *not*
428// the Windows Development Kit.
429void* RtlAllocateHeap(void* HeapHandle, DWORD Flags, size_t Size);
430
431// This function is completely undocumented.
432void*
433RtlReAllocateHeap(void* HeapHandle, DWORD Flags, void* BaseAddress,
434 size_t Size);
435
436// This function is completely undocumented.
437size_t RtlSizeHeap(void* HeapHandle, DWORD Flags, void* BaseAddress);
438
439INTERCEPTOR_WINAPI(size_t, RtlSizeHeap, HANDLE HeapHandle, DWORD Flags,
440 void* BaseAddress) {
441 if (!flags()->windows_hook_rtl_allocators ||
442 UNLIKELY(!AsanInited() || OWNED_BY_RTL(HeapHandle, BaseAddress))) {
443 return REAL(RtlSizeHeap)(HeapHandle, Flags, BaseAddress);
444 }
445 GET_CURRENT_PC_BP_SP;
446 (void)sp;
447 return asan_malloc_usable_size(BaseAddress, pc, bp);
448}
449
450INTERCEPTOR_WINAPI(BOOL, RtlFreeHeap, HANDLE HeapHandle, DWORD Flags,
451 void* BaseAddress) {
452 // Heap allocations happen before this function is hooked, so we must fall
453 // back to the original function if the pointer is not from the ASAN heap, or
454 // unsupported flags are provided.
455 if (!flags()->windows_hook_rtl_allocators ||
456 UNLIKELY((HEAP_FREE_UNSUPPORTED_FLAGS & Flags) != 0 ||
457 OWNED_BY_RTL(HeapHandle, BaseAddress))) {
458 return REAL(RtlFreeHeap)(HeapHandle, Flags, BaseAddress);
459 }
460 GET_STACK_TRACE_FREE;
461 asan_free(BaseAddress, &stack);
462 return true;
463}
464
465INTERCEPTOR_WINAPI(void*, RtlAllocateHeap, HANDLE HeapHandle, DWORD Flags,
466 size_t Size) {
467 // If the ASAN runtime is not initialized, or we encounter an unsupported
468 // flag, fall back to the original allocator.
469 if (!flags()->windows_hook_rtl_allocators ||
470 UNLIKELY(!AsanInited() ||
471 (Flags & HEAP_ALLOCATE_UNSUPPORTED_FLAGS) != 0)) {
472 return REAL(RtlAllocateHeap)(HeapHandle, Flags, Size);
473 }
474 GET_STACK_TRACE_MALLOC;
475 void *p;
476 // Reading MSDN suggests that the *entire* usable allocation is zeroed out.
477 // Otherwise it is difficult to HeapReAlloc with HEAP_ZERO_MEMORY.
478 // https://blogs.msdn.microsoft.com/oldnewthing/20120316-00/?p=8083
479 if (Flags & HEAP_ZERO_MEMORY) {
480 p = asan_calloc(Size, 1, &stack);
481 } else {
482 p = asan_malloc(Size, &stack);
483 }
484 return p;
485}
486
487INTERCEPTOR_WINAPI(void*, RtlReAllocateHeap, HANDLE HeapHandle, DWORD Flags,
488 void* BaseAddress, size_t Size) {
489 // If it's actually a heap block which was allocated before the ASAN runtime
490 // came up, use the real RtlFreeHeap function.
491 if (!flags()->windows_hook_rtl_allocators)
492 return REAL(RtlReAllocateHeap)(HeapHandle, Flags, BaseAddress, Size);
493
494 return SharedReAlloc(REAL(RtlReAllocateHeap), REAL(RtlSizeHeap),
495 REAL(RtlFreeHeap), REAL(RtlAllocateHeap), HeapHandle,
496 Flags, BaseAddress, Size);
497}
498
499namespace __asan {
500
501static void TryToOverrideFunction(const char *fname, uptr new_func) {
502 // Failure here is not fatal. The CRT may not be present, and different CRT
503 // versions use different symbols.
504 if (!__interception::OverrideFunction(fname, new_func))
505 VPrintf(2, "Failed to override function %s\n", fname);
506}
507
508void ReplaceSystemMalloc() {
509 TryToOverrideFunction("free", (uptr)free);
510 TryToOverrideFunction("_free_base", (uptr)free);
511 TryToOverrideFunction("malloc", (uptr)malloc);
512 TryToOverrideFunction("_malloc_base", (uptr)malloc);
513 TryToOverrideFunction("_malloc_crt", (uptr)malloc);
514 TryToOverrideFunction("calloc", (uptr)calloc);
515 TryToOverrideFunction("_calloc_base", (uptr)calloc);
516 TryToOverrideFunction("_calloc_crt", (uptr)calloc);
517 TryToOverrideFunction("realloc", (uptr)realloc);
518 TryToOverrideFunction("_realloc_base", (uptr)realloc);
519 TryToOverrideFunction("_realloc_crt", (uptr)realloc);
520 TryToOverrideFunction("_recalloc", (uptr)_recalloc);
521 TryToOverrideFunction("_recalloc_base", (uptr)_recalloc);
522 TryToOverrideFunction("_recalloc_crt", (uptr)_recalloc);
523 TryToOverrideFunction("_msize", (uptr)_msize);
524 TryToOverrideFunction("_msize_base", (uptr)_msize);
525 TryToOverrideFunction("_expand", (uptr)_expand);
526 TryToOverrideFunction("_expand_base", (uptr)_expand);
527
528 if (flags()->windows_hook_rtl_allocators) {
529 ASAN_INTERCEPT_FUNC(HeapSize);
530 ASAN_INTERCEPT_FUNC(HeapFree);
531 ASAN_INTERCEPT_FUNC(HeapReAlloc);
532 ASAN_INTERCEPT_FUNC(HeapAlloc);
533
534 // Undocumented functions must be intercepted by name, not by symbol.
535 __interception::OverrideFunction("RtlSizeHeap", (uptr)WRAP(RtlSizeHeap),
536 (uptr *)&REAL(RtlSizeHeap));
537 __interception::OverrideFunction("RtlFreeHeap", (uptr)WRAP(RtlFreeHeap),
538 (uptr *)&REAL(RtlFreeHeap));
539 __interception::OverrideFunction("RtlReAllocateHeap",
540 (uptr)WRAP(RtlReAllocateHeap),
541 (uptr *)&REAL(RtlReAllocateHeap));
542 __interception::OverrideFunction("RtlAllocateHeap",
543 (uptr)WRAP(RtlAllocateHeap),
544 (uptr *)&REAL(RtlAllocateHeap));
545 } else {
546#define INTERCEPT_UCRT_FUNCTION(func) \
547 if (!INTERCEPT_FUNCTION_DLLIMPORT( \
548 "ucrtbase.dll", "api-ms-win-core-heap-l1-1-0.dll", func)) { \
549 VPrintf(2, "Failed to intercept ucrtbase.dll import %s\n", #func); \
550 }
551 INTERCEPT_UCRT_FUNCTION(HeapAlloc);
552 INTERCEPT_UCRT_FUNCTION(HeapFree);
553 INTERCEPT_UCRT_FUNCTION(HeapReAlloc);
554 INTERCEPT_UCRT_FUNCTION(HeapSize);
555#undef INTERCEPT_UCRT_FUNCTION
556 }
557 // Recent versions of ucrtbase.dll appear to be built with PGO and LTCG, which
558 // enable cross-module inlining. This means our _malloc_base hook won't catch
559 // all CRT allocations. This code here patches the import table of
560 // ucrtbase.dll so that all attempts to use the lower-level win32 heap
561 // allocation API will be directed to ASan's heap. We don't currently
562 // intercept all calls to HeapAlloc. If we did, we would have to check on
563 // HeapFree whether the pointer came from ASan of from the system.
564}
565} // namespace __asan
566
567#endif // _WIN32
568