Fix memory poisoning with Asan on arbitrary byte boundaries
Asan poisons memory with an 8-byte granularity. We want to make sure that
the whole specified region is poisoned (our typical use case is a
heap-allocated object, and we want to poison the whole object, and we don't
care about the bytes after the end of the object and up to the beginning of
the next object). So align the start and end of the region to (un)poison to
an 8-byte boundary.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
diff --git a/tests/src/test_memory.c b/tests/src/test_memory.c
index 6b1404b..c277be8 100644
--- a/tests/src/test_memory.c
+++ b/tests/src/test_memory.c
@@ -19,11 +19,27 @@
#endif
#if defined(MBEDTLS_TEST_HAVE_ASAN)
+static void align_for_asan(const unsigned char **p_ptr, size_t *p_size)
+{
+ uintptr_t start = (uintptr_t) *p_ptr;
+ uintptr_t end = start + (uintptr_t) *p_size;
+ /* ASan can only poison regions with 8-byte alignment, and only poisons a
+ * region if it's fully within the requested range. We want to poison the
+ * whole requested region and don't mind a few extra bytes. Therefore,
+ * align start down to an 8-byte boundary, and end up to an 8-byte
+ * boundary. */
+ start = start & ~(uintptr_t) 7;
+ end = (end + 7) & ~(uintptr_t) 7;
+ *p_ptr = (const unsigned char *) start;
+ *p_size = end - start;
+}
+
void mbedtls_test_memory_poison(const unsigned char *ptr, size_t size)
{
if (size == 0) {
return;
}
+ align_for_asan(&ptr, &size);
__asan_poison_memory_region(ptr, size);
}
@@ -32,6 +48,7 @@
if (size == 0) {
return;
}
+ align_for_asan(&ptr, &size);
__asan_unpoison_memory_region(ptr, size);
}
#endif /* Asan */