TCMalloc: restrict maximum size of memory ranges

third_party/tcmalloc/chromium/src/page_heap.cc

 // Copyright (c) 2008, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 449 matching lines @@
   t->depth = GetStackTrace(t->stack, kMaxStackDepth-1, 3);
   t->size = growth;
   t->stack[kMaxStackDepth-1] = reinterpret_cast<void*>(Static::growth_stacks());
   Static::set_growth_stacks(t);
 }
 
 bool PageHeap::GrowHeap(Length n) {
   ASSERT(kMaxPages >= kMinSystemAlloc);
   if (n > kMaxValidPages) return false;
   Length ask = (n>kMinSystemAlloc) ? n : static_cast<Length>(kMinSystemAlloc);
+  // Check if it's ok to grow the heap for this much. This is a security
+  // measure to make sure that large allocations fail.
+  if (!IsContiguousAllocSizePermitted(n << kPageShift))

[jar (doing other things), 2013/01/12 16:13:29]

nit: test should come next to similar test in line 468, as it does not depend on
|ask|, and probably should use "return false" on same line to match local
formatting.

+    return false;
   size_t actual_size;
   void* ptr = TCMalloc_SystemAlloc(ask << kPageShift, &actual_size, kPageSize);
   if (ptr == NULL) {
     if (n < ask) {
       // Try growing just "n" pages
       ask = n;
       ptr = TCMalloc_SystemAlloc(ask << kPageShift, &actual_size, kPageSize);
     }
     if (ptr == NULL) return false;
   }
@@ skipping 57 matching lines @@
     CHECK_CONDITION(s->location == freelist);  // NORMAL or RETURNED
     CHECK_CONDITION(s->length >= min_pages);
     CHECK_CONDITION(s->length <= max_pages);
     CHECK_CONDITION(GetDescriptor(s->start) == s);
     CHECK_CONDITION(GetDescriptor(s->start+s->length-1) == s);
   }
   return true;
 }
 
 }  // namespace tcmalloc