-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathsmart.c
68 lines (56 loc) · 1.96 KB
/
smart.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
#include "smart.h"
#include <stdlib.h> // free
#include <string.h> // memset
/* these limits are arbitrary. */
#define STACK_SIZE 256
#define MAX_PER_FRAME 32
typedef struct {
int caller_ebp; /* ebp of the caller. This identifes the frame. */
int caller_eip; /* the original return eip of the caller. */
void *tracked_pointers[MAX_PER_FRAME];
int tail; /* points to one past last entry. */
} tracked_stack_entry_t;
typedef struct {
tracked_stack_entry_t stack[STACK_SIZE];
int tail; /* points to one past last entry. */
} tracked_stack_t;
/* forward declare the assembly trampoline. */
void trampoline ();
tracked_stack_t tracked = {0};
int do_free () {
tracked_stack_entry_t *entry = tracked.stack + (tracked.tail - 1);
tracked.tail--; /* pop. */
for (int i = 0; i < MAX_PER_FRAME; i++) {
if (entry->tracked_pointers[i] == 0) break;
free (entry->tracked_pointers[i]);
}
return entry->caller_eip;
}
void *free_on_exit (void *entry) {
int ret_addr = 0;
int do_free_addr = (int) &do_free;
int *caller_ebp;
/* get the value of ebp. */
__asm__("movl (%%ebp), %0 \n"
: "=r"(caller_ebp) /* output. */
);
/* check if there is a pre-existing stack entry for this caller
* (identified by caller's ebp). */
tracked_stack_entry_t *tracked_entry;
if (tracked.tail > 0 &&
tracked.stack[tracked.tail - 1].caller_ebp == (int) caller_ebp) {
/* re-use. */
tracked_entry = tracked.stack + tracked.tail - 1;
} else {
/* make a new entry. */
tracked_entry = tracked.stack + tracked.tail++;
memset (tracked_entry, 0, sizeof (*tracked_entry));
tracked_entry->caller_ebp = (int) caller_ebp;
/* hijack caller's return eip to return to do_free. */
tracked_entry->caller_eip = *(caller_ebp + 1);
*(caller_ebp + 1) = (int) trampoline;
}
/* push the passed pointer. */
tracked_entry->tracked_pointers[tracked_entry->tail++] = entry;
return entry;
}