Skip to content

Commit

Permalink
Fix generic trampoline string leak.
Browse files Browse the repository at this point in the history
Generic trampolines were leaking strings because:
1. The mono_arch_create_generic_trampoline function uses mono_get_generic_trampoline_name which does strdup.
2. That string was passed into mono_tramp_info_create which did strdup again.

The fix is to free the string after passing it to mono_tramp_info_create.
  • Loading branch information
aarononeal committed Jul 24, 2013
1 parent 2c6dc87 commit c931c46
Show file tree
Hide file tree
Showing 6 changed files with 36 additions and 14 deletions.
8 changes: 6 additions & 2 deletions mono/mini/tramp-amd64.c
Expand Up @@ -412,6 +412,7 @@ stack_unaligned (MonoTrampolineType tramp_type)
guchar*
mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInfo **info, gboolean aot)
{
char *tramp_name;
guint8 *buf, *code, *tramp, *br [2], *r11_save_code, *after_r11_save_code;
int i, lmf_offset, offset, res_offset, arg_offset, rax_offset, tramp_offset, saved_regs_offset;
int saved_fpregs_offset, rbp_offset, framesize, orig_rsp_to_rbp_offset, cfa_offset;
Expand Down Expand Up @@ -724,8 +725,11 @@ mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInf
nullified_class_init_trampoline = mono_arch_get_nullified_class_init_trampoline (NULL);
}

if (info)
*info = mono_tramp_info_create (mono_get_generic_trampoline_name (tramp_type), buf, code - buf, ji, unwind_ops);
if (info) {
tramp_name = mono_get_generic_trampoline_name (tramp_type);
*info = mono_tramp_info_create (tramp_name, buf, code - buf, ji, unwind_ops);
g_free (tramp_name);
}

return buf;
}
Expand Down
8 changes: 6 additions & 2 deletions mono/mini/tramp-arm.c
Expand Up @@ -192,6 +192,7 @@ emit_bx (guint8* code, int reg)
guchar*
mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInfo **info, gboolean aot)
{
char *tramp_name;
guint8 *buf, *code = NULL;
#ifdef USE_JUMP_TABLES
gpointer *load_get_lmf_addr = NULL, *load_trampoline = NULL;
Expand Down Expand Up @@ -455,8 +456,11 @@ mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInf
/* Initialize the nullified class init trampoline used in the AOT case */
nullified_class_init_trampoline = mono_arch_get_nullified_class_init_trampoline (NULL);

if (info)
*info = mono_tramp_info_create (mono_get_generic_trampoline_name (tramp_type), buf, code - buf, ji, unwind_ops);
if (info) {
tramp_name = mono_get_generic_trampoline_name (tramp_type);
*info = mono_tramp_info_create (tramp_name, buf, code - buf, ji, unwind_ops);
g_free (tramp_name);
}

return buf;
}
Expand Down
8 changes: 6 additions & 2 deletions mono/mini/tramp-mips.c
Expand Up @@ -176,6 +176,7 @@ mono_arch_get_nullified_class_init_trampoline (MonoTrampInfo **info)
guchar*
mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInfo **info, gboolean aot)
{
char *tramp_name;
guint8 *buf, *tramp, *code = NULL;
int i, lmf;
GSList *unwind_ops = NULL;
Expand Down Expand Up @@ -317,8 +318,11 @@ mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInf
/* Initialize the nullified class init trampoline used in the AOT case */
nullified_class_init_trampoline = mono_arch_get_nullified_class_init_trampoline (NULL);

if (info)
*info = mono_tramp_info_create (mono_get_generic_trampoline_name (tramp_type), buf, code - buf, ji, unwind_ops);
if (info) {
tramp_name = mono_get_generic_trampoline_name (tramp_type);
*info = mono_tramp_info_create (tramp_name, buf, code - buf, ji, unwind_ops);
g_free (tramp_name);
}

return buf;
}
Expand Down
9 changes: 6 additions & 3 deletions mono/mini/tramp-ppc.c
Expand Up @@ -248,7 +248,7 @@ mono_arch_nullify_plt_entry (guint8 *code, mgreg_t *regs)
guchar*
mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInfo **info, gboolean aot)
{

char *tramp_name;
guint8 *buf, *code = NULL;
int i, offset;
gconstpointer tramp_handler;
Expand Down Expand Up @@ -445,8 +445,11 @@ mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInf
nullified_class_init_trampoline = mono_ppc_create_ftnptr (mono_arch_get_nullified_class_init_trampoline (NULL));
}

if (info)
*info = mono_tramp_info_create (mono_get_generic_trampoline_name (tramp_type), buf, code - buf, ji, unwind_ops);
if (info) {
tramp_name = mono_get_generic_trampoline_name (tramp_type);
*info = mono_tramp_info_create (tramp_name, buf, code - buf, ji, unwind_ops);
g_free (tramp_name);
}

return buf;
}
Expand Down
9 changes: 6 additions & 3 deletions mono/mini/tramp-s390x.c
Expand Up @@ -219,6 +219,7 @@ mono_arch_nullify_plt_entry (guint8 *code, mgreg_t *regs)
guchar*
mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInfo **info, gboolean aot)
{
char *tramp_name;
guint8 *buf, *tramp, *code;
int i, offset, lmfOffset;
GSList *unwind_ops = NULL;
Expand Down Expand Up @@ -401,9 +402,11 @@ mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInf
/* Flush instruction cache, since we've generated code */
mono_arch_flush_icache (code, buf - code);

if (info)
*info = mono_tramp_info_create (mono_get_generic_trampoline_name(tramp_type),
buf, buf - code, ji, unwind_ops);
if (info) {
tramp_name = mono_get_generic_trampoline_name (tramp_type);
*info = mono_tramp_info_create (tramp_name, buf, buf - code, ji, unwind_ops);
g_free (tramp_name);
}

/* Sanity check */
g_assert ((buf - code) <= 512);
Expand Down
8 changes: 6 additions & 2 deletions mono/mini/tramp-x86.c
Expand Up @@ -305,6 +305,7 @@ mono_arch_nullify_plt_entry (guint8 *code, mgreg_t *regs)
guchar*
mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInfo **info, gboolean aot)
{
char *tramp_name;
guint8 *buf, *code, *tramp;
int pushed_args, pushed_args_caller_saved;
GSList *unwind_ops = NULL;
Expand Down Expand Up @@ -529,8 +530,11 @@ mono_arch_create_generic_trampoline (MonoTrampolineType tramp_type, MonoTrampInf
nacl_global_codeman_validate (&buf, 256, &code);
g_assert ((code - buf) <= 256);

if (info)
*info = mono_tramp_info_create (mono_get_generic_trampoline_name (tramp_type), buf, code - buf, ji, unwind_ops);
if (info) {
tramp_name = mono_get_generic_trampoline_name (tramp_type);
*info = mono_tramp_info_create (tramp_name, buf, code - buf, ji, unwind_ops);
g_free (tramp_name);
}

if (tramp_type == MONO_TRAMPOLINE_CLASS_INIT) {
/* Initialize the nullified class init trampoline used in the AOT case */
Expand Down

0 comments on commit c931c46

Please sign in to comment.