Skip to content

Commit

Permalink
Set PAGE_NO_ACCESS when calling OSAllocatorWin protect rw: false
Browse files Browse the repository at this point in the history
https://bugs.webkit.org/show_bug.cgi?id=260069

Reviewed by Don Olmstead and Yusuke Suzuki.

In OSAllocatorWin, if you call OSAllocator::protect with readable false
and writeable false, it’ll free the page + decommit. To the caller,
this looks like it does the right thing - attempting to access the
freed page will throw an access violation. However by freeing the page
there’s a risk that we re-allocate that page later.

For WasmMemory we want the pages to remain reserved in the virtual
address space, so if someone tries to access memory in a “red zone”
page it’ll throw an access violation. If that page is re-allocated, we
could overflow WasmMemory and read / write that page.

Switched OSAllocatorWin to set PAGE_NOACCESS instead of freeing the
page when protect is called with readable and writeable false.

* Source/WTF/wtf/win/OSAllocatorWin.cpp:
(WTF::OSAllocator::protect):

Canonical link: https://commits.webkit.org/266876@main
  • Loading branch information
iangrunert authored and donny-dont committed Aug 14, 2023
1 parent 3beeb08 commit 673b5ea
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions Source/WTF/wtf/win/OSAllocatorWin.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -143,10 +143,11 @@ bool OSAllocator::protect(void* address, size_t bytes, bool readable, bool writa
protection = PAGE_READWRITE;
else
protection = PAGE_READONLY;
return VirtualAlloc(address, bytes, MEM_COMMIT, protection);
} else {
ASSERT(!readable && !writable);
protection = PAGE_NOACCESS;
}
ASSERT(!readable && !writable);
return VirtualFree(address, bytes, MEM_DECOMMIT);
return VirtualAlloc(address, bytes, MEM_COMMIT, protection);
}

} // namespace WTF

0 comments on commit 673b5ea

Please sign in to comment.