MachMessageServer: scribble over memory allocations in debug mode

util/mach/mach_message_server.cc

 // Copyright 2014 The Crashpad Authors. All rights reserved.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
 //     http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
 #include "util/mach/mach_message_server.h"
 
+#include <string.h>
+
 #include <limits>
 
 #include "base/logging.h"
 #include "base/mac/mach_logging.h"
 #include "base/mac/scoped_mach_vm.h"
 #include "util/mach/mach_message.h"
 
 namespace crashpad {
 
 namespace {
@@ skipping 14 matching lines @@
   //!     available.
   //!
   //! If the existing buffer is a different size, it will be reallocated without
   //! copying any of the old buffer’s contents to the new buffer. The contents
   //! of the buffer are unspecified after this call, even if no reallocation is
   //! performed.
   kern_return_t Reallocate(vm_size_t size) {
     // This test uses == instead of > so that a large reallocation to receive a
     // large message doesn’t cause permanent memory bloat for the duration of
     // a MachMessageServer::Run() loop.
-    if (size == vm_.size()) {
-      return KERN_SUCCESS;
+    if (size != vm_.size()) {
+      // reset() first, so that two allocations don’t exist simultaneously.
+      vm_.reset();
+
+      if (size) {
+        vm_address_t address;
+        kern_return_t kr =
+            vm_allocate(mach_task_self(),
+                        &address,
+                        size,
+                        VM_FLAGS_ANYWHERE | VM_MAKE_TAG(VM_MEMORY_MACH_MSG));
+        if (kr != KERN_SUCCESS) {
+          return kr;
+        }
+
+        vm_.reset(address, size);
+      }
     }
 
-    // reset() first, so that two allocations don’t exist simultaneously.
-    vm_.reset();
-
-    if (size) {
-      vm_address_t address;
-      kern_return_t kr =
-          vm_allocate(mach_task_self(),
-                      &address,
-                      size,
-                      VM_FLAGS_ANYWHERE | VM_MAKE_TAG(VM_MEMORY_MACH_MSG));
-      if (kr != KERN_SUCCESS) {
-        return kr;
-      }
-
-      vm_.reset(address, size);
-    }
+#if !defined(NDEBUG)
+    // Regardless of whether the allocation was changed, scribble over the
+    // memory to make sure that nothing relies on zero-initialization or stale
+    // contents.
+    memset(Header(), 0x66, size);
+#endif
 
     return KERN_SUCCESS;
   }
 
  private:
   base::mac::ScopedMachVM vm_;
 
   DISALLOW_COPY_AND_ASSIGN(MachMessageBuffer);
 };
 
@@ skipping 190 matching lines @@
         }
         return kr;
       }
     }
   } while (persistent == kPersistent || retry);
 
   return kr;
 }
 
 }  // namespace crashpad