Mirror/Momentum-Firmware
1
0
Fork 0
mirror of https://github.com/Next-Flip/Momentum-Firmware.git synced 2026-07-11 23:38:11 -07:00
Code Issues Packages Projects Releases Wiki Activity

Furi: Detect use-after-free

Browse Source
This commit is contained in:
Willy-JL
2024-11-09 02:37:01 +00:00
parent 51aafd1b5e
commit a26631f11b
2 changed files with 47 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
furi/core/memmgr_heap.c
+1 -1
View File
@@ -527,7 +527,7 @@ void vPortFree(void* pv) {
/* Add this block to the list of free blocks. */
xFreeBytesRemaining += pxLink->xBlockSize;
traceFREE(pv, pxLink->xBlockSize);
memset(pv, 0, pxLink->xBlockSize - xHeapStructSize);
memset(pv, 0xDD, pxLink->xBlockSize - xHeapStructSize);
prvInsertBlockIntoFreeList((BlockLink_t*)pxLink);
}
(void)xTaskResumeAll();
targets/f7/furi_hal/furi_hal_interrupt.c
+46 -1
View File
@@ -314,7 +314,52 @@ void MemManage_Handler(void) {
}
void BusFault_Handler(void) {
furi_crash("BusFault");
const char* crash_msg = "BusFault";
furi_log_puts("\r\n" _FURI_LOG_CLR_E "Bus fault:\r\n");
if(FURI_BIT(SCB->CFSR, SCB_CFSR_LSPERR_Pos)) {
furi_log_puts(" - lazy stacking for exception entry\r\n");
}
if(FURI_BIT(SCB->CFSR, SCB_CFSR_STKERR_Pos)) {
furi_log_puts(" - stacking for exception entry\r\n");
}
if(FURI_BIT(SCB->CFSR, SCB_CFSR_UNSTKERR_Pos)) {
furi_log_puts(" - unstacking for exception return\r\n");
}
if(FURI_BIT(SCB->CFSR, SCB_CFSR_IMPRECISERR_Pos)) {
furi_log_puts(" - imprecise data access\r\n");
}
if(FURI_BIT(SCB->CFSR, SCB_CFSR_PRECISERR_Pos)) {
furi_log_puts(" - precise data access\r\n");
}
if(FURI_BIT(SCB->CFSR, SCB_CFSR_IBUSERR_Pos)) {
furi_log_puts(" - instruction\r\n");
}
if(FURI_BIT(SCB->CFSR, SCB_CFSR_BFARVALID_Pos)) {
uint32_t busfault_address = SCB->BFAR;
furi_log_puts(" -- at 0x");
char tmp_str[] = "0xFFFFFFFF";
itoa(busfault_address, tmp_str, 16);
furi_log_puts(tmp_str);
furi_log_puts("\r\n");
if(busfault_address == (uint32_t)NULL) {
furi_log_puts(" -- NULL pointer dereference\r\n");
} else if(busfault_address >= 0xDDDDDDDD && busfault_address <= 0xDDDEDDDD) {
crash_msg = "Possible use-after-free";
}
}
furi_log_puts(_FURI_LOG_CLR_RESET);
furi_crash(crash_msg);
}
void UsageFault_Handler(void) {