TCMalloc: restrict maximum size of memory ranges

third_party/tcmalloc/chromium/src/system-alloc.cc

 // Copyright (c) 2005, Google Inc.
 // All rights reserved.
 // 
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 // 
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 29 matching lines @@
 #include <inttypes.h>
 #else
 #include <sys/types.h>
 #endif
 #ifdef HAVE_MMAP
 #include <sys/mman.h>                   // for munmap, mmap, MADV_DONTNEED, etc
 #endif
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>                     // for sbrk, getpagesize, off_t
 #endif
+#include <limits>
 #include <new>                          // for operator new
 #include <gperftools/malloc_extension.h>
 #include "base/basictypes.h"
 #include "base/commandlineflags.h"
 #include "base/spinlock.h"              // for SpinLockHolder, SpinLock, etc
 #include "common.h"
 #include "internal_logging.h"
 
 // On systems (like freebsd) that don't define MAP_ANONYMOUS, use the old
 // form of the name instead.
@@ skipping 141 matching lines @@
   // Check if we should use sbrk allocation.
   // FLAGS_malloc_skip_sbrk starts out as false (its uninitialized
   // state) and eventually gets initialized to the specified value.  Note
   // that this code runs for a while before the flags are initialized.
   // That means that even if this flag is set to true, some (initial)
   // memory will be allocated with sbrk before the flag takes effect.
   if (FLAGS_malloc_skip_sbrk) {
     return NULL;
   }
 
+  // The first time we call into the allocator, record the current pointer
+  // to the break. This will be used to calculate the total size.
+  static const char* initial_brk_address = static_cast<char*>(sbrk(0));
+
   // sbrk will release memory if passed a negative number, so we do
   // a strict check here
   if (static_cast<ptrdiff_t>(size + alignment) < 0) return NULL;
 
   // This doesn't overflow because TCMalloc_SystemAlloc has already
   // tested for overflow at the alignment boundary.
   size = ((size + alignment - 1) / alignment) * alignment;
 
   // "actual_size" indicates that the bytes from the returned pointer
   // p up to and including (p + actual_size - 1) have been allocated.
   if (actual_size) {
     *actual_size = size;
   }
 
   // Check that we we're not asking for so much more memory that we'd
   // wrap around the end of the virtual address space.  (This seems
   // like something sbrk() should check for us, and indeed opensolaris
   // does, but glibc does not:
   //    http://src.opensolaris.org/source/xref/onnv/onnv-gate/usr/src/lib/libc/port/sys/sbrk.c?a=true
   //    http://sourceware.org/cgi-bin/cvsweb.cgi/~checkout~/libc/misc/sbrk.c?rev=1.1.2.1&content-type=text/plain&cvsroot=glibc
   // Without this check, sbrk may succeed when it ought to fail.)
-  if (reinterpret_cast<intptr_t>(sbrk(0)) + size < size) {
+  const char* current_brk_address = static_cast<char*>(sbrk(0));
+  if (reinterpret_cast<intptr_t>(current_brk_address) + size < size) {
     return NULL;
   }
 
+  ASSERT(current_brk_address >= initial_brk_address);
+  const size_t current_alloc_size =
+      static_cast<size_t>(current_brk_address - initial_brk_address);
+  ASSERT(current_alloc_size <=
+         std::numeric_limits<std::size_t>::max() - size);
+
+  if (!tcmalloc::IsContiguousAllocSizePermitted(current_alloc_size + size))
+    return NULL;
+
   void* result = sbrk(size);
   if (result == reinterpret_cast<void*>(-1)) {
     return NULL;
   }
 
   // Is it aligned?
   uintptr_t ptr = reinterpret_cast<uintptr_t>(result);
   if ((ptr & (alignment-1)) == 0)  return result;
 
   // Try to get more memory for alignment
@@ skipping 224 matching lines @@
 
   SpinLockHolder lock_holder(&spinlock);
 
   if (!system_alloc_inited) {
     InitSystemAllocators();
     system_alloc_inited = true;
   }
 
   // Enforce minimum alignment
   if (alignment < sizeof(MemoryAligner)) alignment = sizeof(MemoryAligner);
 

[jln (very slow on Chromium), 2013/01/11 06:02:29]

We could also add the limit check here, instead of page_heap.cc, but we would
also need to add it to windows/port.cc

   void* result = sys_alloc->Alloc(size, actual_size, alignment);
   if (result != NULL) {
     if (actual_size) {
       CheckAddressBits<kAddressBits>(
           reinterpret_cast<uintptr_t>(result) + *actual_size - 1);
     } else {
       CheckAddressBits<kAddressBits>(
           reinterpret_cast<uintptr_t>(result) + size - 1);
     }
   }
@@ skipping 49 matching lines @@
     }
   }
 #endif
 }
 
 void TCMalloc_SystemCommit(void* start, size_t length) {
   // Nothing to do here.  TCMalloc_SystemRelease does not alter pages
   // such that they need to be re-committed before they can be used by the
   // application.
 }