TCMalloc: restrict maximum size of memory ranges

third_party/tcmalloc/chromium/src/tcmalloc.cc

 // Copyright (c) 2005, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 1060 matching lines @@
   return result;
 }
 
 inline void* do_malloc(size_t size) {
   AddRoomForMark(&size);
 
   void* ret = NULL;
 
   // The following call forces module initialization
   ThreadCache* heap = ThreadCache::GetCache();
-  if (size <= kMaxSize) {
-    size_t cl = Static::sizemap()->SizeClass(size);
-    size = Static::sizemap()->class_to_size(cl);
+  // First, check if our security policy allows this size.
+  if (tcmalloc::IsAllocSizePermitted(size)) {
+    if (size <= kMaxSize) {
+      size_t cl = Static::sizemap()->SizeClass(size);
+      size = Static::sizemap()->class_to_size(cl);
 
-    // TODO(jar): If this has any detectable performance impact, it can be
-    // optimized by only tallying sizes if the profiler was activated to recall
-    // these tallies.  I don't think this is performance critical, but we really
-    // should measure it.
-    heap->AddToByteAllocatedTotal(size);  // Chromium profiling.
+      // TODO(jar): If this has any detectable performance impact, it can be
+      // optimized by only tallying sizes if the profiler was activated to
+      // recall these tallies.  I don't think this is performance critical, but
+      // we really should measure it.
+      heap->AddToByteAllocatedTotal(size);  // Chromium profiling.
 
-    if ((FLAGS_tcmalloc_sample_parameter > 0) && heap->SampleAllocation(size)) {
-      ret = DoSampledAllocation(size);
+      if ((FLAGS_tcmalloc_sample_parameter > 0) &&
+          heap->SampleAllocation(size)) {
+        ret = DoSampledAllocation(size);
+        MarkAllocatedRegion(ret);
+      } else {
+        // The common case, and also the simplest.  This just pops the
+        // size-appropriate freelist, after replenishing it if it's empty.
+        ret = CheckMallocResult(heap->Allocate(size, cl));
+      }
+    } else {
+      ret = do_malloc_pages(heap, size);
       MarkAllocatedRegion(ret);
-    } else {
-      // The common case, and also the simplest.  This just pops the
-      // size-appropriate freelist, after replenishing it if it's empty.
-      ret = CheckMallocResult(heap->Allocate(size, cl));
     }
-  } else {
-    ret = do_malloc_pages(heap, size);
-    MarkAllocatedRegion(ret);
   }
   if (ret == NULL) errno = ENOMEM;
   return ret;
 }
 
 inline void* do_calloc(size_t n, size_t elem_size) {
   // Overflow check
   const size_t size = n * elem_size;
   if (elem_size != 0 && size / elem_size != n) return NULL;
 
@@ skipping 114 matching lines @@
   AddRoomForMark(&new_size);
   // Get the size of the old entry
   const size_t old_size = GetSizeWithCallback(old_ptr, invalid_get_size_fn);
 
   // Reallocate if the new size is larger than the old size,
   // or if the new size is significantly smaller than the old size.
   // We do hysteresis to avoid resizing ping-pongs:
   //    . If we need to grow, grow to max(new_size, old_size * 1.X)
   //    . Don't shrink unless new_size < old_size * 0.Y
   // X and Y trade-off time for wasted space.  For now we do 1.25 and 0.5.
-  const int lower_bound_to_grow = old_size + old_size / 4;
-  const int upper_bound_to_shrink = old_size / 2;
+  const size_t lower_bound_to_grow = old_size + old_size / 4;
+  const size_t upper_bound_to_shrink = old_size / 2;
   if ((new_size > old_size) || (new_size < upper_bound_to_shrink)) {
     // Need to reallocate.
     void* new_ptr = NULL;
 
     if (new_size > old_size && new_size < lower_bound_to_grow) {
       new_ptr = do_malloc_or_cpp_alloc(lower_bound_to_grow);
     }
     ExcludeMarkFromSize(&new_size);  // do_malloc will add space if needed.
     if (new_ptr == NULL) {
       // Either new_size is not a tiny increment, or last do_malloc failed.
@@ skipping 606 matching lines @@
   *mark = ~allocated_mark;  //  Distinctively not allocated.
 }
 
 static void MarkAllocatedRegion(void* ptr) {
   if (ptr == NULL) return;
   MarkType* mark = GetMarkLocation(ptr);
   *mark = GetMarkValue(ptr, mark);
 }
 
 #endif  // TCMALLOC_VALIDATION