{"thread":{"id":"31524","subject":"[PATCHv2] Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption","startedAt":"2012-09-13T16:59:19Z","lastAt":"2012-09-13T16:59:19Z","messageCount":1,"participants":["Elia Pinto"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"198936","messageId":"1347555559-5341-1-git-send-email-gitter.spiros@gmail.com","threadId":"31524","inReplyTo":null,"subject":"[PATCHv2] Add MALLOC_CHECK_ and MALLOC_PERTURB_ libc env to the test suite for detecting heap corruption","fromName":"Elia Pinto","fromEmail":"gitter.spiros@gmail.com","sentAt":"2012-09-13T16:59:19Z","receivedAt":"2012-09-13T16:59:19Z","isPatch":false,"sender":{"key":"gitter.spiros@gmail.com","avatar":"https://avatars.githubusercontent.com/u/158490?v=4"},"body":"Recent versions of Linux libc (later than 5.4.23) and glibc (2.x)\ninclude a malloc() implementation which is tunable via environment\nvariables. When MALLOC_CHECK_ is set, a special (less efficient)\nimplementation is used which is designed to be tolerant against\nsimple errors, such as double calls of free() with the same argument,\nor overruns of a single byte (off-by-one bugs). When MALLOC_CHECK_\nis set to 3, a diagnostic message is printed on stderr\nand the program is aborted.\n\nSetting the MALLOC_PERTURB_ environment variable causes the malloc\nfunctions in libc to return memory which has been wiped and clear\nmemory when it is returned.\nOf course this does not affect calloc which always does clear the memory.\n\nThe reason for this exercise is, of course, to find code which uses\nmemory returned by malloc without initializing it and code which uses\ncode after it is freed. valgrind can do this but it's costly to run.\nThe MALLOC_PERTURB_ exchanges the ability to detect problems in 100%\nof the cases with speed.\n\nThe byte value used to initialize values returned by malloc is the byte\nvalue of the environment value. The value used to clear memory is the\nbitwise inverse. Setting MALLOC_PERTURB_ to zero disables the feature.\n\nThis technique can find hard to detect bugs.\nIt is therefore suggested to always use this flag (at least temporarily)\nwhen testing out code or a new distribution.\n\nSigned-off-by: Elia Pinto <gitter.spiros@gmail.com>\n---\nThis the second reroll of the original patch.\n\nI redid the patch correcting the export command in a more portable\nway thanks to the Junio observation.\n\n t/test-lib.sh |    8 ++++++++\n 1 file changed, 8 insertions(+)\n\ndiff --git a/t/test-lib.sh b/t/test-lib.sh\nindex 78c4286..6317ffc 100644\n--- a/t/test-lib.sh\n+++ b/t/test-lib.sh\n@@ -93,6 +93,14 @@ export GIT_AUTHOR_EMAIL GIT_AUTHOR_NAME\n export GIT_COMMITTER_EMAIL GIT_COMMITTER_NAME\n export EDITOR\n \n+# Add libc malloc_check and MALLOC_PERTURB test \n+MALLOC_CHECK_=3\n+export MALLOC_CHECK_\n+MALLOC_PERTURB_=\"$( expr \\( $$ % 255 \\) + 1)\"\n+export MALLOC_PERTURB_\n+#\n+\n+\n # Protect ourselves from common misconfiguration to export\n # CDPATH into the environment\n unset CDPATH\n-- \n1.7.10.4\n"}]}