|
|
|
|
@ -1140,7 +1140,7 @@ def try_free(addr) -> None:
|
|
|
|
|
# try to get the chunk
|
|
|
|
|
try:
|
|
|
|
|
chunk = read_chunk(addr)
|
|
|
|
|
except gdb.MemoryError as e:
|
|
|
|
|
except gdb.MemoryError:
|
|
|
|
|
print(message.error(f"Can't read chunk at address 0x{addr:x}, memory error"))
|
|
|
|
|
return
|
|
|
|
|
|
|
|
|
|
@ -1202,9 +1202,9 @@ def try_free(addr) -> None:
|
|
|
|
|
tc_idx = (chunk_size_unmasked - chunk_minsize + malloc_alignment - 1) // malloc_alignment
|
|
|
|
|
if tc_idx < allocator.mp["tcache_bins"]:
|
|
|
|
|
print(message.notice("Tcache checks"))
|
|
|
|
|
e = addr + 2 * size_sz # type: ignore[misc]
|
|
|
|
|
e += allocator.tcache_entry.keys().index("key") * ptr_size # type: ignore[misc]
|
|
|
|
|
e = pwndbg.gdblib.memory.pvoid(e) # type: ignore[misc]
|
|
|
|
|
e = addr + 2 * size_sz
|
|
|
|
|
e += allocator.tcache_entry.keys().index("key") * ptr_size
|
|
|
|
|
e = pwndbg.gdblib.memory.pvoid(e)
|
|
|
|
|
tcache_addr = int(allocator.thread_cache.address)
|
|
|
|
|
if e == tcache_addr:
|
|
|
|
|
# todo, actually do checks
|
|
|
|
|
@ -1267,7 +1267,7 @@ def try_free(addr) -> None:
|
|
|
|
|
if fastbin_top_chunk != 0:
|
|
|
|
|
try:
|
|
|
|
|
fastbin_top_chunk = read_chunk(fastbin_top_chunk)
|
|
|
|
|
except gdb.MemoryError as e:
|
|
|
|
|
except gdb.MemoryError:
|
|
|
|
|
print(
|
|
|
|
|
message.error(
|
|
|
|
|
f"Can't read top fastbin chunk at address 0x{fastbin_top_chunk:x}, memory error"
|
|
|
|
|
@ -1323,7 +1323,7 @@ def try_free(addr) -> None:
|
|
|
|
|
try:
|
|
|
|
|
next_chunk = read_chunk(next_chunk_addr)
|
|
|
|
|
next_chunk_size = chunksize(unsigned_size(next_chunk["size"]))
|
|
|
|
|
except (OverflowError, gdb.MemoryError) as e:
|
|
|
|
|
except (OverflowError, gdb.MemoryError):
|
|
|
|
|
print(message.error(f"Can't read next chunk at address 0x{next_chunk_addr:x}"))
|
|
|
|
|
finalize(errors_found, returned_before_error)
|
|
|
|
|
return
|
|
|
|
|
@ -1353,7 +1353,7 @@ def try_free(addr) -> None:
|
|
|
|
|
try:
|
|
|
|
|
prev_chunk = read_chunk(prev_chunk_addr)
|
|
|
|
|
prev_chunk_size = chunksize(unsigned_size(prev_chunk["size"]))
|
|
|
|
|
except (OverflowError, gdb.MemoryError) as e:
|
|
|
|
|
except (OverflowError, gdb.MemoryError):
|
|
|
|
|
print(message.error(f"Can't read next chunk at address 0x{prev_chunk_addr:x}"))
|
|
|
|
|
finalize(errors_found, returned_before_error)
|
|
|
|
|
return
|
|
|
|
|
@ -1376,7 +1376,7 @@ def try_free(addr) -> None:
|
|
|
|
|
try:
|
|
|
|
|
next_next_chunk_addr = next_chunk_addr + next_chunk_size
|
|
|
|
|
next_next_chunk = read_chunk(next_next_chunk_addr)
|
|
|
|
|
except (OverflowError, gdb.MemoryError) as e:
|
|
|
|
|
except (OverflowError, gdb.MemoryError):
|
|
|
|
|
print(message.error(f"Can't read next chunk at address 0x{next_next_chunk_addr:x}"))
|
|
|
|
|
finalize(errors_found, returned_before_error)
|
|
|
|
|
return
|
|
|
|
|
@ -1405,14 +1405,14 @@ def try_free(addr) -> None:
|
|
|
|
|
)
|
|
|
|
|
print(message.error(err))
|
|
|
|
|
errors_found += 1
|
|
|
|
|
except (OverflowError, gdb.MemoryError) as e:
|
|
|
|
|
except (OverflowError, gdb.MemoryError):
|
|
|
|
|
print(
|
|
|
|
|
message.error(
|
|
|
|
|
f"Can't read chunk at 0x{unsorted['fd']:x}, it is unsorted bin fd"
|
|
|
|
|
)
|
|
|
|
|
)
|
|
|
|
|
errors_found += 1
|
|
|
|
|
except (OverflowError, gdb.MemoryError) as e:
|
|
|
|
|
except (OverflowError, gdb.MemoryError):
|
|
|
|
|
print(message.error(f"Can't read unsorted bin chunk at 0x{unsorted_addr:x}"))
|
|
|
|
|
errors_found += 1
|
|
|
|
|
|
|
|
|
|
|