From c9ccea401437df85b37956a2196350ec5c8a9e7d Mon Sep 17 00:00:00 2001 From: TermiNexus Date: Tue, 25 Aug 2026 17:17:29 +0800 Subject: [PATCH] =?UTF-8?q?feat(memhub):=20=E4=B8=8B=E6=BA=A2=E5=86=99?= =?UTF-8?q?=E6=89=93=E5=8D=B0=E5=A2=9E=E5=BC=BA=E2=80=94=E2=80=94=E5=9D=97?= =?UTF-8?q?=E5=A4=B4/=E8=AE=B0=E5=BD=95index/=E4=B8=8A=E4=B8=8B=E6=96=87/?= =?UTF-8?q?=E5=90=8Cptr=E8=AE=B0=E5=BD=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SlotsBugTest 越过 can 问题后新信号：free 块前标记(block+8..9)被写零（前标记区是安全区，子块边界2^n>=32永不落此，free-list写只在block+0..7）→ 真实下溢/UAF写。 增强打印：hdr 块头值（判断 free-list 状态）、记录 index、±3 上下文记录、同 ptr 记录（F/A 标注），一次运行定位写入者。 --- includes/memhub.vp | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/includes/memhub.vp b/includes/memhub.vp index beb0f20..ded5011 100644 --- a/includes/memhub.vp +++ b/includes/memhub.vp @@ -894,8 +894,31 @@ class MemBuddy(MemManager): m_fr: t.CUInt16T | t.CPtr = (t.CUInt16T | t.CPtr)(t.CVoid(p - 2, t.CPtr)) mfv_r: t.CUInt16T = m_fr[0] if mfv_r != t.CUInt16T(MEMBUDDY_DET_MARKER): - stdio.printf("[DET] 下溢写: ptr=%llu size=%llu（free 后前标记被破坏，前标记=0x%04X）\n", - p, real_s, t.CUInt32T(mfv_r)) + stdio.printf("[DET] 下溢写: ptr=%llu size=%llu（free 后前标记被破坏，前标记=0x%04X）hdr=0x%llX 记录[%zu]\n", + p, real_s, t.CUInt32T(mfv_r), hdr_v, i) + # 记录上下文 ±3（同越界写打印，定位 free 块分配/释放阶段） + stdio.printf("记录上下文: ") + ci_r: t.CInt = -3 + while ci_r <= 3: + idx_r: t.CSizeT = t.CSizeT(t.CInt(i) + ci_r) + if idx_r < self._det_count: + cip_r: t.CUInt64T = self._det_records[idx_r * 2] + cis_r: t.CUInt64T = self._det_records[idx_r * 2 + 1] + stdio.printf("[%d]ptr=%llu sz=%llu ", ci_r, cip_r, cis_r & (free_flag - 1)) + ci_r += 1 + # 同 ptr 记录（free/active 复用链，判断块是否被二次分配/释放） + stdio.printf("\n同ptr记录: ") + ci3_r: t.CSizeT = 0 + while ci3_r < self._det_count: + cp3_r: t.CUInt64T = self._det_records[ci3_r * 2] + cs3_r: t.CUInt64T = self._det_records[ci3_r * 2 + 1] + if cp3_r == p: + st_r: str = "A" + if (cs3_r & free_flag) != 0: + st_r = "F" + stdio.printf("[%zu]sz=%llu%s ", ci3_r, cs3_r & (free_flag - 1), st_r) + ci3_r += 1 + stdio.printf("\n") stdlib.exit(1) i += 1 continue