[SyzyAsan] Fix overflow error in ShadowWalker for 4GB 32-bit processes.

syzygy/agent/asan/shadow.h

 // Copyright 2012 Google Inc. All Rights Reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
@@ skipping 276 matching lines @@
   // @param size The extent of the memory to be marked.
   // @note Grabs a global shadow lock.
   void MarkPagesProtected(const void* addr, size_t size);
 
   // Marks a given range of pages as being unprotected.
   // @param addr The first page to be marked.
   // @param size The extent of the memory to be marked.
   // @note Grabs a global shadow lock.
   void MarkPagesUnprotected(const void* addr, size_t size);
 
-  // Returns the size of memory represented by the shadow.
-  const size_t memory_size() const { return length_ << kShadowRatioLog; }
+  // Returns the size of memory represented by the shadow. This is a 64-bit
+  // result to prevent overflow for 4GB 32-bit processes.
+  const uint64_t memory_size() const {
+    return static_cast<uint64_t>(length_) << kShadowRatioLog;
+  }
 
   // Read only accessor of shadow memory.
   // @returns a pointer to the actual shadow memory.
   const uint8_t* shadow() const { return shadow_; }
 
   // Returns the length of the shadow array.
   size_t length() const { return length_; }
 
   // Read only accessor of page protection bits.
   const uint8_t* page_bits() const { return page_bits_; }
@@ skipping 106 matching lines @@
 class ShadowWalker {
  public:
   // Constructor.
   // @param shadow The shadow memory object to walk.
   // @param recursive If true then this will recursively descend into nested
   //     blocks. Otherwise it will only return the outermost blocks in the
   //     provided region.
   // @param lower_bound The lower bound of the region that this walker should
   //     cover in the actual memory.
   // @param upper_bound The upper bound of the region that this walker should
-  //     cover in the actual memory.
+  //     cover in the actual memory. This can overflow to 0 to indicate walking
+  //     all of memory.
   ShadowWalker(const Shadow* shadow,
                bool recursive,
                const void* lower_bound,
                const void* upper_bound);
 
   // Return the next block in this memory region.
   // @param info The block information to be populated.
   // @return true if a block was found, false otherwise.
   bool Next(BlockInfo* info);
 
   // Reset the walker to its initial state.
   void Reset();
 
   // @returns the nesting depth of the last returned block. If no blocks have
   //     been walked then this returns -1.
   int nesting_depth() const { return nesting_depth_; }
 
  private:
   // The shadow memory being walked.
   const Shadow* shadow_;
 
   // Indicates whether or not the walker will descend recursively into nested
   // blocks.
   bool recursive_;
 
-  // The bounds of the memory region for this walker.
-  const uint8_t* lower_bound_;
-  const uint8_t* upper_bound_;
+  // The bounds of the memory region for this walker, expressed as pointers in
+  // the shadow memory. This allows walking to occur without worrying about
+  // overflow.
+  size_t lower_index_;
+  size_t upper_index_;
 
-  // The current cursor of the shadow walker. This points to upper_bound_ when
-  // the walk is terminated.
-  const uint8_t* cursor_;
-
-  // The shadow cursor. This is maintained simply for debugging and to ensure
-  // that the shadow memory associated with |cursor_| makes it into the crash
-  // report.
+  // The shadow cursor.
   const uint8_t* shadow_cursor_;
 
   // The current nesting depth. Starts at -1.
   int nesting_depth_;
 
   DISALLOW_COPY_AND_ASSIGN(ShadowWalker);
 };
 
 // The static shadow memory that is referred to by the memory interceptors.
 // These are provided by one of 'dummy_shadow.cc' or 'static_shadow.cc'.
 extern "C" {
 extern const size_t asan_memory_interceptors_shadow_memory_size;
 extern uint8_t asan_memory_interceptors_shadow_memory[];
 }
 
 // Bring in the implementation of the templated functions.
 #include "syzygy/agent/asan/shadow_impl.h"
 
 }  // namespace asan
 }  // namespace agent
 
 #endif  // SYZYGY_AGENT_ASAN_SHADOW_H_