From 769ffda04f4167bee093822cc77850f7d27c9fb0 Mon Sep 17 00:00:00 2001 From: TermiNexus Date: Tue, 25 Aug 2026 15:12:48 +0800 Subject: [PATCH] =?UTF-8?q?feat(memhub):=20detection=20=E8=A1=A5=E5=89=8D?= =?UTF-8?q?=E6=A0=87=E8=AE=B0=E6=8E=A2=E6=B5=8B=EF=BC=88=E5=AF=B9=E7=A7=B0?= =?UTF-8?q?=E6=8B=A6=E6=88=AA=E4=B8=8B=E6=BA=A2=E5=86=99=EF=BC=89=20-=20ac?= =?UTF-8?q?tive=20=E8=AE=B0=E5=BD=95=E9=AA=8C=E8=AF=81=E8=BF=94=E5=9B=9Ept?= =?UTF-8?q?r-2=20=E5=A4=84=200xCDCD=EF=BC=8Cfree=20=E8=AE=B0=E5=BD=95?= =?UTF-8?q?=E5=90=8C=E6=A0=B7=E9=AA=8C=E8=AF=81=E5=89=8D=E6=A0=87=E8=AE=B0?= =?UTF-8?q?+=E7=94=A8=E6=88=B7=E5=8C=BA=200xCD=EF=BC=9B=E4=B8=8E=E5=90=8E?= =?UTF-8?q?=E6=A0=87=E8=AE=B0=E4=B8=8A=E6=BA=A2=E6=A3=80=E6=B5=8B=E3=80=81?= =?UTF-8?q?free=20=E5=A1=AB=200xCD=20=E7=9A=84=20UAF=20=E5=86=99=E5=85=A5?= =?UTF-8?q?=E6=A3=80=E6=B5=8B=E6=9E=84=E6=88=90=E5=AE=8C=E6=95=B4=E4=B8=89?= =?UTF-8?q?=E6=96=B9=E8=A6=86=E7=9B=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- includes/memhub.vp | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/includes/memhub.vp b/includes/memhub.vp index f64d733..418523f 100644 --- a/includes/memhub.vp +++ b/includes/memhub.vp @@ -833,13 +833,19 @@ class MemBuddy(MemManager): p: t.CUInt64T = self._det_records[i * 2] s: t.CUInt64T = self._det_records[i * 2 + 1] if (s & free_flag) != 0: - # free 记录：块头仍为 0（未被重新 alloc）则验证用户区 0xCD - # 完整——被写穿 = use-after-free 写入（free 后块被某代码覆盖） + # free 记录：块头仍为 0（未被重新 alloc）则验证前标记 + 用户区 + # 0xCD 完整——被写穿 = use-after-free 写入 / 下溢写 real_s: t.CUInt64T = s & (free_flag - 1) if real_s > 0: blk_h: t.CUInt64T = p - 2 - MEMBUDDY_HEADER_SIZE hdr_v: t.CUInt64T = t.CUInt64T(c.Deref(t.CUInt64T(blk_h, t.CPtr))) if (hdr_v & 1) == 0: + m_fr: t.CUInt16T | t.CPtr = (t.CUInt16T | t.CPtr)(t.CVoid(p - 2, t.CPtr)) + mfv_r: t.CUInt16T = m_fr[0] + if mfv_r != t.CUInt16T(MEMBUDDY_DET_MARKER): + stdio.printf("[DET] 下溢写: ptr=%llu size=%llu（free 后前标记被破坏，前标记=0x%04X）\n", + p, real_s, t.CUInt32T(mfv_r)) + stdlib.exit(1) w0: t.CUInt64T = t.CUInt64T(c.Deref(t.CUInt64T(p, t.CPtr))) w1: t.CUInt64T = w0 if real_s >= 8: @@ -853,6 +859,13 @@ class MemBuddy(MemManager): if s == 0: i += 1 continue # 无 size 记录（理论不发生，防御） + # active 记录：前标记（下溢检测）+ 后标记（上溢检测） + m_fa: t.CUInt16T | t.CPtr = (t.CUInt16T | t.CPtr)(t.CVoid(p - 2, t.CPtr)) + mfv_a: t.CUInt16T = m_fa[0] + if mfv_a != t.CUInt16T(MEMBUDDY_DET_MARKER): + stdio.printf("[DET] 下溢写: ptr=%llu size=%llu 前标记=0x%04X（期望 0xCDCD）\n", + p, s, t.CUInt32T(mfv_a)) + stdlib.exit(1) m16: t.CUInt16T | t.CPtr = (t.CUInt16T | t.CPtr)(t.CVoid(p + s, t.CPtr)) mv: t.CUInt16T = m16[0] if mv != t.CUInt16T(MEMBUDDY_DET_MARKER):