memsafer-generic.cpp revision b013dbfb0905a5fc4c7218cc08f63b156d0126a0
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * IPRT - Memory Allocate for Sensitive Data, generic heap-based implementation.
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * Copyright (C) 2006-2014 Oracle Corporation
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * This file is part of VirtualBox Open Source Edition (OSE), as
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * available from http://www.virtualbox.org. This file is free software;
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * you can redistribute it and/or modify it under the terms of the GNU
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * General Public License (GPL) as published by the Free Software
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * Foundation, in version 2 as it comes in the "COPYING" file of the
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * The contents of this file may alternatively be used under the terms
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * of the Common Development and Distribution License Version 1.0
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * VirtualBox OSE distribution, in which case the provisions of the
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * CDDL are applicable instead of those of the GPL.
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * You may elect to license modified versions of this file under the
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * terms and conditions of either the GPL or the CDDL or both.
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy/*******************************************************************************
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy* Header Files *
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy*******************************************************************************/
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy#if defined(IN_SUP_R3) && defined(VBOX) && !defined(RT_NO_GIP)
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy#endif /* IN_SUP_R3 */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy/*******************************************************************************
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy* Defined Constants And Macros *
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy*******************************************************************************/
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy/** Allocation size alignment. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy/** Padding after the block to avoid small overruns. */
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy/** Padding after the block to avoid small underruns. */
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy/*******************************************************************************
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy* Structures and Typedefs *
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy*******************************************************************************/
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * Supported allocation methods.
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy /** Invalid method. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy /** RTMem{Alloc|Free} methods, least secure!. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy /** Support library. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy /** 32bit hack. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy RTMEMSAFERALLOCMETHOD_32BIT_HACK = 0x7fffffff
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy/** Pointer to a allocation method enum. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedytypedef RTMEMSAFERALLOCMETHOD *PRTMEMSAFERALLOCMETHOD;
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * Memory header for safer memory allocations.
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * @note: There is no magic value used deliberately to make identifying this structure
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * as hard as possible.
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy /** Flags passed to this allocation - used for freeing and reallocation. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy /** Allocation method used. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy /** Amount of bytes allocated. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy/** Pointer to a safer memory header. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy/** Make sure we are staying in the padding area. */
f38cb554a534c6df738be3f4d23327e69888e634John Wren KennedyAssertCompile(sizeof(RTMEMSAFERHDR) < RTMEMSAFER_PAD_BEFORE);
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy/*******************************************************************************
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy* Global Variables *
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy*******************************************************************************/
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy/** XOR scrambler value.
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * @todo determine this at runtime */
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedystatic uintptr_t g_uScramblerXor = UINT32_C(0x867af88d);
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedystatic uintptr_t g_uScramblerXor = UINT64_C(0xed95ecc99416d312);
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * Support (SUPR3) based allocator.
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * @returns VBox status code.
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * @retval VERR_NOT_SUPPORTED if this allocation method is not supported in this
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * version of the library.
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * @param ppvNew Where to store the pointer to the new buffer on success.
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * @param cb Amount of bytes to allocate.
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * @note: The allocation will have an extra page allocated before and after the
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy * user area with all access rights removed if the host supports that to
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * prevent heartbleed like attacks.
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedystatic int rtMemSaferSupR3Alloc(void **ppvNew, size_t cb)
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy#if defined(IN_SUP_R3) && defined(VBOX) && !defined(RT_NO_GIP)
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * Allocate locked memory from the support library.
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy size_t cbUser = RT_ALIGN_Z(cb, PAGE_SIZE);
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy size_t cPages = cbUser / PAGE_SIZE + 2; /* For the extra guarding pages. */
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy int rc = SUPR3PageAllocEx(cPages, 0 /* fFlags */, &pvNew, NULL /* pR0Ptr */, NULL /* paPages */);
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * Change the memory protection of the pages guarding the allocation.
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy * Some hosts don't support changing the page protection, ignore these
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy rc = SUPR3PageProtect(pvNew, NIL_RTR0PTR, 0, PAGE_SIZE, RTMEM_PROT_NONE);
1d32ba663e202c24a5a1f2e5aef83fffb447cb7fJohn Wren Kennedy if (RT_SUCCESS(rc) || rc == VERR_NOT_SUPPORTED)
f38cb554a534c6df738be3f4d23327e69888e634John Wren Kennedy Assert(PAGE_SIZE + cbUser == (size_t)((uint32_t)(PAGE_SIZE + cbUser)));
rc = SUPR3PageProtect(pvNew, NIL_RTR0PTR, PAGE_SIZE + (uint32_t)cbUser, PAGE_SIZE, RTMEM_PROT_NONE);
return VINF_SUCCESS;
return rc;
return VERR_NOT_SUPPORTED;
while (cb > 0)
pu++;
return VINF_SUCCESS;
while (cb > 0)
pu++;
return VINF_SUCCESS;
RTDECL(int) RTMemSaferAllocZExTag(void **ppvNew, size_t cb, uint32_t fFlags, const char *pszTag) RT_NO_THROW
if (pvNew)
return VINF_SUCCESS;
return rc;
if (pv)
RTDECL(int) RTMemSaferReallocZExTag(size_t cbOld, void *pvOld, size_t cbNew, void **ppvNew, uint32_t fFlags, const char *pszTag) RT_NO_THROW
int rc;
void *pvNew;
else if (!cbOld)
return rc;
return pvNew;
return NULL;
RTDECL(void *) RTMemSaferReallocZTag(size_t cbOld, void *pvOld, size_t cbNew, const char *pszTag) RT_NO_THROW
int rc = RTMemSaferReallocZExTag(cbOld, pvOld, cbNew, &pvNew, RTMEMSAFER_ALLOC_EX_FLAGS_DEFAULT, pszTag);
return pvNew;
return NULL;