src/libstrongswan/utils/leak_detective.c

   1 /*
   2  * Copyright (C) 2013-2014 Tobias Brunner
   3  * Copyright (C) 2006-2013 Martin Willi
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #define _GNU_SOURCE
  18 #include <stddef.h>
  19 #include <string.h>
  20 #include <stdio.h>
  21 #include <signal.h>
  22 #include <unistd.h>
  23 #include <locale.h>
  24 #ifdef HAVE_DLADDR
  25 #include <dlfcn.h>
  26 #endif
  27 #include <time.h>
  28 #include <errno.h>
  29
  30 #ifdef __APPLE__
  31 #include <sys/mman.h>
  32 #include <malloc/malloc.h>
  33 /* overload some of our types clashing with mach */
  34 #define host_t strongswan_host_t
  35 #define processor_t strongswan_processor_t
  36 #define thread_t strongswan_thread_t
  37 #endif /* __APPLE__ */
  38
  39 #include "leak_detective.h"
  40
  41 #include <library.h>
  42 #include <utils/utils.h>
  43 #include <utils/debug.h>
  44 #include <utils/backtrace.h>
  45 #include <collections/hashtable.h>
  46 #include <threading/thread_value.h>
  47 #include <threading/spinlock.h>
  48
  49 typedef struct private_leak_detective_t private_leak_detective_t;
  50
  51 /**
  52  * private data of leak_detective
  53  */
  54 struct private_leak_detective_t {
  55
  56         /**
  57          * public functions
  58          */
  59         leak_detective_t public;
  60
  61         /**
  62          * Registered report() function
  63          */
  64         leak_detective_report_cb_t report_cb;
  65
  66         /**
  67          * Registered report() summary function
  68          */
  69         leak_detective_summary_cb_t report_scb;
  70
  71         /**
  72          * Registered user data for callbacks
  73          */
  74         void *report_data;
  75 };
  76
  77 /**
  78  * Magic value which helps to detect memory corruption. Yummy!
  79  */
  80 #define MEMORY_HEADER_MAGIC 0x7ac0be11
  81
  82 /**
  83  * Magic written to tail of allocation
  84  */
  85 #define MEMORY_TAIL_MAGIC 0xcafebabe
  86
  87 /**
  88  * Pattern which is filled in memory before freeing it
  89  */
  90 #define MEMORY_FREE_PATTERN 0xFF
  91
  92 /**
  93  * Pattern which is filled in newly allocated memory
  94  */
  95 #define MEMORY_ALLOC_PATTERN 0xEE
  96
  97 typedef struct memory_header_t memory_header_t;
  98 typedef struct memory_tail_t memory_tail_t;
  99
 100 /**
 101  * Header which is prepended to each allocated memory block
 102  */
 103 struct memory_header_t {
 104
 105         /**
 106          * Pointer to previous entry in linked list
 107          */
 108         memory_header_t *previous;
 109
 110         /**
 111          * Pointer to next entry in linked list
 112          */
 113         memory_header_t *next;
 114
 115         /**
 116          * backtrace taken during (re-)allocation
 117          */
 118         backtrace_t *backtrace;
 119
 120         /**
 121          * Padding to make sizeof(memory_header_t) == 32
 122          */
 123         u_int32_t padding[sizeof(void*) == sizeof(u_int32_t) ? 3 : 0];
 124
 125         /**
 126          * Number of bytes following after the header
 127          */
 128         u_int32_t bytes;
 129
 130         /**
 131          * magic bytes to detect bad free or heap underflow, MEMORY_HEADER_MAGIC
 132          */
 133         u_int32_t magic;
 134
 135 }__attribute__((__packed__));
 136
 137 /**
 138  * tail appended to each allocated memory block
 139  */
 140 struct memory_tail_t {
 141
 142         /**
 143          * Magic bytes to detect heap overflow, MEMORY_TAIL_MAGIC
 144          */
 145         u_int32_t magic;
 146
 147 }__attribute__((__packed__));
 148
 149 /**
 150  * first mem header is just a dummy to chain
 151  * the others on it...
 152  */
 153 static memory_header_t first_header = {
 154         .magic = MEMORY_HEADER_MAGIC,
 155 };
 156
 157 /**
 158  * Spinlock to access header linked list
 159  */
 160 static spinlock_t *lock;
 161
 162 /**
 163  * Is leak detection currently enabled?
 164  */
 165 static bool enabled = FALSE;
 166
 167 /**
 168  * Is leak detection disabled for the current thread?
 169  */
 170 static thread_value_t *thread_disabled;
 171
 172 /**
 173  * Installs the malloc hooks, enables leak detection
 174  */
 175 static void enable_leak_detective()
 176 {
 177         enabled = TRUE;
 178 }
 179
 180 /**
 181  * Uninstalls the malloc hooks, disables leak detection
 182  */
 183 static void disable_leak_detective()
 184 {
 185         enabled = FALSE;
 186 }
 187
 188 /**
 189  * Enable/Disable leak detective for the current thread
 190  *
 191  * @return Previous value
 192  */
 193 static bool enable_thread(bool enable)
 194 {
 195         bool before;
 196
 197         before = thread_disabled->get(thread_disabled) == NULL;
 198         thread_disabled->set(thread_disabled, enable ? NULL : (void*)TRUE);
 199         return before;
 200 }
 201
 202 /**
 203  * Add a header to the beginning of the list
 204  */
 205 static void add_hdr(memory_header_t *hdr)
 206 {
 207         lock->lock(lock);
 208         hdr->next = first_header.next;
 209         if (hdr->next)
 210         {
 211                 hdr->next->previous = hdr;
 212         }
 213         hdr->previous = &first_header;
 214         first_header.next = hdr;
 215         lock->unlock(lock);
 216 }
 217
 218 /**
 219  * Remove a header from the list
 220  */
 221 static void remove_hdr(memory_header_t *hdr)
 222 {
 223         lock->lock(lock);
 224         if (hdr->next)
 225         {
 226                 hdr->next->previous = hdr->previous;
 227         }
 228         hdr->previous->next = hdr->next;
 229         lock->unlock(lock);
 230 }
 231
 232 /**
 233  * Check if a header is in the list
 234  */
 235 static bool has_hdr(memory_header_t *hdr)
 236 {
 237         memory_header_t *current;
 238         bool found = FALSE;
 239
 240         lock->lock(lock);
 241         for (current = &first_header; current != NULL; current = current->next)
 242         {
 243                 if (current == hdr)
 244                 {
 245                         found = TRUE;
 246                         break;
 247                 }
 248         }
 249         lock->unlock(lock);
 250
 251         return found;
 252 }
 253
 254 #ifdef __APPLE__
 255
 256 /**
 257  * Copy of original default zone, with functions we call in hooks
 258  */
 259 static malloc_zone_t original;
 260
 261 /**
 262  * Call original malloc()
 263  */
 264 static void* real_malloc(size_t size)
 265 {
 266         return original.malloc(malloc_default_zone(), size);
 267 }
 268
 269 /**
 270  * Call original free()
 271  */
 272 static void real_free(void *ptr)
 273 {
 274         original.free(malloc_default_zone(), ptr);
 275 }
 276
 277 /**
 278  * Call original realloc()
 279  */
 280 static void* real_realloc(void *ptr, size_t size)
 281 {
 282         return original.realloc(malloc_default_zone(), ptr, size);
 283 }
 284
 285 /**
 286  * Hook definition: static function with _hook suffix, takes additional zone
 287  */
 288 #define HOOK(ret, name, ...) \
 289         static ret name ## _hook(malloc_zone_t *_z, __VA_ARGS__)
 290
 291 /**
 292  * forward declaration of hooks
 293  */
 294 HOOK(void*, malloc, size_t bytes);
 295 HOOK(void*, calloc, size_t nmemb, size_t size);
 296 HOOK(void*, valloc, size_t size);
 297 HOOK(void, free, void *ptr);
 298 HOOK(void*, realloc, void *old, size_t bytes);
 299
 300 /**
 301  * malloc zone size(), must consider the memory header prepended
 302  */
 303 HOOK(size_t, size, const void *ptr)
 304 {
 305         bool before;
 306         size_t size;
 307
 308         if (enabled)
 309         {
 310                 before = enable_thread(FALSE);
 311                 if (before)
 312                 {
 313                         ptr -= sizeof(memory_header_t);
 314                 }
 315         }
 316         size = original.size(malloc_default_zone(), ptr);
 317         if (enabled)
 318         {
 319                 enable_thread(before);
 320         }
 321         return size;
 322 }
 323
 324 /**
 325  * Version of malloc zones we currently support
 326  */
 327 #define MALLOC_ZONE_VERSION 8 /* Snow Leopard */
 328
 329 /**
 330  * Hook-in our malloc functions into the default zone
 331  */
 332 static bool register_hooks()
 333 {
 334         static bool once = FALSE;
 335         malloc_zone_t *zone;
 336         void *page;
 337
 338         if (once)
 339         {
 340                 return TRUE;
 341         }
 342         once = TRUE;
 343
 344         zone = malloc_default_zone();
 345         if (zone->version != MALLOC_ZONE_VERSION)
 346         {
 347                 DBG1(DBG_CFG, "malloc zone version %d unsupported (requiring %d)",
 348                          zone->version, MALLOC_ZONE_VERSION);
 349                 return FALSE;
 350         }
 351
 352         original = *zone;
 353
 354         page = (void*)((uintptr_t)zone / getpagesize() * getpagesize());
 355         if (mprotect(page, getpagesize(), PROT_WRITE | PROT_READ) != 0)
 356         {
 357                 DBG1(DBG_CFG, "malloc zone unprotection failed: %s", strerror(errno));
 358                 return FALSE;
 359         }
 360
 361         zone->size = size_hook;
 362         zone->malloc = malloc_hook;
 363         zone->calloc = calloc_hook;
 364         zone->valloc = valloc_hook;
 365         zone->free = free_hook;
 366         zone->realloc = realloc_hook;
 367
 368         /* those other functions can be NULLed out to not use them */
 369         zone->batch_malloc = NULL;
 370         zone->batch_free = NULL;
 371         zone->memalign = NULL;
 372         zone->free_definite_size = NULL;
 373
 374         return TRUE;
 375 }
 376
 377 #else /* !__APPLE__ */
 378
 379 /**
 380  * dlsym() might do a malloc(), but we can't do one before we get the malloc()
 381  * function pointer. Use this minimalistic malloc implementation instead.
 382  */
 383 static void* malloc_for_dlsym(size_t size)
 384 {
 385         static char buf[1024] = {};
 386         static size_t used = 0;
 387         char *ptr;
 388
 389         /* roundup to a multiple of 32 */
 390         size = (size - 1) / 32 * 32 + 32;
 391
 392         if (used + size > sizeof(buf))
 393         {
 394                 return NULL;
 395         }
 396         ptr = buf + used;
 397         used += size;
 398         return ptr;
 399 }
 400
 401 /**
 402  * Lookup a malloc function, while disabling wrappers
 403  */
 404 static void* get_malloc_fn(char *name)
 405 {
 406         bool before = FALSE;
 407         void *fn;
 408
 409         if (enabled)
 410         {
 411                 before = enable_thread(FALSE);
 412         }
 413         fn = dlsym(RTLD_NEXT, name);
 414         if (enabled)
 415         {
 416                 enable_thread(before);
 417         }
 418         return fn;
 419 }
 420
 421 /**
 422  * Call original malloc()
 423  */
 424 static void* real_malloc(size_t size)
 425 {
 426         static void* (*fn)(size_t size);
 427         static int recursive = 0;
 428
 429         if (!fn)
 430         {
 431                 /* checking recursiveness should actually be thread-specific. But as
 432                  * it is very likely that the first allocation is done before we go
 433                  * multi-threaded, we keep it simple. */
 434                 if (recursive)
 435                 {
 436                         return malloc_for_dlsym(size);
 437                 }
 438                 recursive++;
 439                 fn = get_malloc_fn("malloc");
 440                 recursive--;
 441         }
 442         return fn(size);
 443 }
 444
 445 /**
 446  * Call original free()
 447  */
 448 static void real_free(void *ptr)
 449 {
 450         static void (*fn)(void *ptr);
 451
 452         if (!fn)
 453         {
 454                 fn = get_malloc_fn("free");
 455         }
 456         return fn(ptr);
 457 }
 458
 459 /**
 460  * Call original realloc()
 461  */
 462 static void* real_realloc(void *ptr, size_t size)
 463 {
 464         static void* (*fn)(void *ptr, size_t size);
 465
 466         if (!fn)
 467         {
 468                 fn = get_malloc_fn("realloc");
 469         }
 470         return fn(ptr, size);
 471 }
 472
 473 /**
 474  * Hook definition: plain function overloading existing malloc calls
 475  */
 476 #define HOOK(ret, name, ...) ret name(__VA_ARGS__)
 477
 478 /**
 479  * Hook initialization when not using hooks, resolve functions.
 480  */
 481 static bool register_hooks()
 482 {
 483         void *buf = real_malloc(8);
 484         buf = real_realloc(buf, 16);
 485         real_free(buf);
 486         return TRUE;
 487 }
 488
 489 #endif /* !__APPLE__ */
 490
 491 /**
 492  * Leak report white list
 493  *
 494  * List of functions using static allocation buffers or should be suppressed
 495  * otherwise on leak report.
 496  */
 497 char *whitelist[] = {
 498         /* backtraces, including own */
 499         "backtrace_create",
 500         "strerror_safe",
 501         /* pthread stuff */
 502         "pthread_create",
 503         "pthread_setspecific",
 504         "__pthread_setspecific",
 505         /* glibc functions */
 506         "inet_ntoa",
 507         "strerror",
 508         "getprotobyname",
 509         "getprotobynumber",
 510         "getservbyport",
 511         "getservbyname",
 512         "gethostbyname",
 513         "gethostbyname2",
 514         "gethostbyname_r",
 515         "gethostbyname2_r",
 516         "getnetbyname",
 517         "getpwnam_r",
 518         "getgrnam_r",
 519         "register_printf_function",
 520         "register_printf_specifier",
 521         "syslog",
 522         "vsyslog",
 523         "__syslog_chk",
 524         "__vsyslog_chk",
 525         "getaddrinfo",
 526         "setlocale",
 527         "getpass",
 528         "getpwent_r",
 529         "setpwent",
 530         "endpwent",
 531         "getspnam_r",
 532         "getpwuid_r",
 533         "initgroups",
 534         "tzset",
 535         /* ignore dlopen, as we do not dlclose to get proper leak reports */
 536         "dlopen",
 537         "dlerror",
 538         "dlclose",
 539         "dlsym",
 540         /* mysql functions */
 541         "mysql_init_character_set",
 542         "init_client_errs",
 543         "my_thread_init",
 544         /* fastcgi library */
 545         "FCGX_Init",
 546         /* libxml */
 547         "xmlInitCharEncodingHandlers",
 548         "xmlInitParser",
 549         "xmlInitParserCtxt",
 550         /* libcurl */
 551         "Curl_client_write",
 552         /* ClearSilver */
 553         "nerr_init",
 554         /* libgcrypt */
 555         "gcry_control",
 556         "gcry_check_version",
 557         "gcry_randomize",
 558         "gcry_create_nonce",
 559         /* OpenSSL: These are needed for unit-tests only, the openssl plugin
 560          * does properly clean up any memory during destroy(). */
 561         "ECDSA_do_sign_ex",
 562         "ECDSA_verify",
 563         "RSA_new_method",
 564         /* OpenSSL libssl */
 565         "SSL_COMP_get_compression_methods",
 566         /* NSPR */
 567         "PR_CallOnce",
 568         /* libapr */
 569         "apr_pool_create_ex",
 570         /* glib */
 571         "g_type_init_with_debug_flags",
 572         "g_type_register_static",
 573         "g_type_class_ref",
 574         "g_type_create_instance",
 575         "g_type_add_interface_static",
 576         "g_type_interface_add_prerequisite",
 577         "g_socket_connection_factory_lookup_type",
 578         /* libgpg */
 579         "gpg_err_init",
 580         /* gnutls */
 581         "gnutls_global_init",
 582 };
 583
 584 /**
 585  * Some functions are hard to whitelist, as they don't use a symbol directly.
 586  * Use some static initialization to suppress them on leak reports
 587  */
 588 static void init_static_allocations()
 589 {
 590         struct tm tm;
 591         time_t t = 0;
 592
 593         tzset();
 594         gmtime_r(&t, &tm);
 595         localtime_r(&t, &tm);
 596 }
 597
 598 /**
 599  * Hashtable hash function
 600  */
 601 static u_int hash(backtrace_t *key)
 602 {
 603         enumerator_t *enumerator;
 604         void *addr;
 605         u_int hash = 0;
 606
 607         enumerator = key->create_frame_enumerator(key);
 608         while (enumerator->enumerate(enumerator, &addr))
 609         {
 610                 hash = chunk_hash_inc(chunk_from_thing(addr), hash);
 611         }
 612         enumerator->destroy(enumerator);
 613
 614         return hash;
 615 }
 616
 617 /**
 618  * Hashtable equals function
 619  */
 620 static bool equals(backtrace_t *a, backtrace_t *b)
 621 {
 622         return a->equals(a, b);
 623 }
 624
 625 /**
 626  * Summarize and print backtraces
 627  */
 628 static int print_traces(private_leak_detective_t *this,
 629                                                 leak_detective_report_cb_t cb, void *user,
 630                                                 int thresh, int thresh_count,
 631                                                 bool detailed, int *whitelisted, size_t *sum)
 632 {
 633         int leaks = 0;
 634         memory_header_t *hdr;
 635         enumerator_t *enumerator;
 636         hashtable_t *entries;
 637         struct {
 638                 /** associated backtrace */
 639                 backtrace_t *backtrace;
 640                 /** total size of all allocations */
 641                 size_t bytes;
 642                 /** number of allocations */
 643                 u_int count;
 644         } *entry;
 645         bool before;
 646
 647         before = enable_thread(FALSE);
 648
 649         entries = hashtable_create((hashtable_hash_t)hash,
 650                                                            (hashtable_equals_t)equals, 1024);
 651         lock->lock(lock);
 652         for (hdr = first_header.next; hdr != NULL; hdr = hdr->next)
 653         {
 654                 if (whitelisted &&
 655                         hdr->backtrace->contains_function(hdr->backtrace,
 656                                                                                           whitelist, countof(whitelist)))
 657                 {
 658                         (*whitelisted)++;
 659                         continue;
 660                 }
 661                 entry = entries->get(entries, hdr->backtrace);
 662                 if (entry)
 663                 {
 664                         entry->bytes += hdr->bytes;
 665                         entry->count++;
 666                 }
 667                 else
 668                 {
 669                         INIT(entry,
 670                                 .backtrace = hdr->backtrace->clone(hdr->backtrace),
 671                                 .bytes = hdr->bytes,
 672                                 .count = 1,
 673                         );
 674                         entries->put(entries, entry->backtrace, entry);
 675                 }
 676                 if (sum)
 677                 {
 678                         *sum += hdr->bytes;
 679                 }
 680                 leaks++;
 681         }
 682         lock->unlock(lock);
 683
 684         enumerator = entries->create_enumerator(entries);
 685         while (enumerator->enumerate(enumerator, NULL, &entry))
 686         {
 687                 if (cb)
 688                 {
 689                         if (!thresh || entry->bytes >= thresh)
 690                         {
 691                                 if (!thresh_count || entry->count >= thresh_count)
 692                                 {
 693                                         this->report_cb(this->report_data, entry->count,
 694                                                                         entry->bytes, entry->backtrace, detailed);
 695                                 }
 696                         }
 697                 }
 698                 entry->backtrace->destroy(entry->backtrace);
 699                 free(entry);
 700         }
 701         enumerator->destroy(enumerator);
 702         entries->destroy(entries);
 703
 704         enable_thread(before);
 705         return leaks;
 706 }
 707
 708 METHOD(leak_detective_t, report, void,
 709         private_leak_detective_t *this, bool detailed)
 710 {
 711         if (lib->leak_detective)
 712         {
 713                 int leaks, whitelisted = 0;
 714                 size_t sum = 0;
 715
 716                 leaks = print_traces(this, this->report_cb, this->report_data,
 717                                                          0, 0, detailed, &whitelisted, &sum);
 718                 if (this->report_scb)
 719                 {
 720                         this->report_scb(this->report_data, leaks, sum, whitelisted);
 721                 }
 722         }
 723 }
 724
 725 METHOD(leak_detective_t, set_report_cb, void,
 726         private_leak_detective_t *this, leak_detective_report_cb_t cb,
 727         leak_detective_summary_cb_t scb, void *user)
 728 {
 729         this->report_cb = cb;
 730         this->report_scb = scb;
 731         this->report_data = user;
 732 }
 733
 734 METHOD(leak_detective_t, leaks, int,
 735         private_leak_detective_t *this)
 736 {
 737         int whitelisted = 0;
 738
 739         return print_traces(this, NULL, NULL, 0, 0, FALSE, &whitelisted, NULL);
 740 }
 741
 742 METHOD(leak_detective_t, set_state, bool,
 743         private_leak_detective_t *this, bool enable)
 744 {
 745         return enable_thread(enable);
 746 }
 747
 748 METHOD(leak_detective_t, usage, void,
 749         private_leak_detective_t *this, leak_detective_report_cb_t cb,
 750         leak_detective_summary_cb_t scb, void *user)
 751 {
 752         bool detailed;
 753         int thresh, thresh_count, leaks, whitelisted = 0;
 754         size_t sum = 0;
 755
 756         thresh = lib->settings->get_int(lib->settings,
 757                                                 "%s.leak_detective.usage_threshold", 10240, lib->ns);
 758         thresh_count = lib->settings->get_int(lib->settings,
 759                                                 "%s.leak_detective.usage_threshold_count", 0, lib->ns);
 760         detailed = lib->settings->get_bool(lib->settings,
 761                                                 "%s.leak_detective.detailed", TRUE, lib->ns);
 762
 763         leaks = print_traces(this, cb, user, thresh, thresh_count,
 764                                                  detailed, &whitelisted, &sum);
 765         if (scb)
 766         {
 767                 scb(user, leaks, sum, whitelisted);
 768         }
 769 }
 770
 771 /**
 772  * Wrapped malloc() function
 773  */
 774 HOOK(void*, malloc, size_t bytes)
 775 {
 776         memory_header_t *hdr;
 777         memory_tail_t *tail;
 778         bool before;
 779
 780         if (!enabled || thread_disabled->get(thread_disabled))
 781         {
 782                 return real_malloc(bytes);
 783         }
 784
 785         hdr = real_malloc(sizeof(memory_header_t) + bytes + sizeof(memory_tail_t));
 786         tail = ((void*)hdr) + bytes + sizeof(memory_header_t);
 787         /* set to something which causes crashes */
 788         memset(hdr, MEMORY_ALLOC_PATTERN,
 789                    sizeof(memory_header_t) + bytes + sizeof(memory_tail_t));
 790
 791         before = enable_thread(FALSE);
 792         hdr->backtrace = backtrace_create(2);
 793         enable_thread(before);
 794
 795         hdr->magic = MEMORY_HEADER_MAGIC;
 796         hdr->bytes = bytes;
 797         tail->magic = MEMORY_TAIL_MAGIC;
 798
 799         add_hdr(hdr);
 800
 801         return hdr + 1;
 802 }
 803
 804 /**
 805  * Wrapped calloc() function
 806  */
 807 HOOK(void*, calloc, size_t nmemb, size_t size)
 808 {
 809         void *ptr;
 810
 811         size *= nmemb;
 812         ptr = malloc(size);
 813         memset(ptr, 0, size);
 814
 815         return ptr;
 816 }
 817
 818 /**
 819  * Wrapped valloc(), TODO: currently not supported
 820  */
 821 HOOK(void*, valloc, size_t size)
 822 {
 823         DBG1(DBG_LIB, "valloc() used, but leak-detective hook missing");
 824         return NULL;
 825 }
 826
 827 /**
 828  * Wrapped free() function
 829  */
 830 HOOK(void, free, void *ptr)
 831 {
 832         memory_header_t *hdr;
 833         memory_tail_t *tail;
 834         backtrace_t *backtrace;
 835         bool before;
 836
 837         if (!enabled || thread_disabled->get(thread_disabled))
 838         {
 839                 real_free(ptr);
 840                 return;
 841         }
 842         /* allow freeing of NULL */
 843         if (ptr == NULL)
 844         {
 845                 return;
 846         }
 847         hdr = ptr - sizeof(memory_header_t);
 848         tail = ptr + hdr->bytes;
 849
 850         before = enable_thread(FALSE);
 851         if (hdr->magic != MEMORY_HEADER_MAGIC ||
 852                 tail->magic != MEMORY_TAIL_MAGIC)
 853         {
 854                 if (has_hdr(hdr))
 855                 {
 856                         /* memory was allocated by our hooks but is corrupted */
 857                         fprintf(stderr, "freeing corrupted memory (%p): "
 858                                         "header magic 0x%x, tail magic 0x%x:\n",
 859                                         ptr, hdr->magic, tail->magic);
 860                 }
 861                 else
 862                 {
 863                         /* memory was not allocated by our hooks */
 864                         fprintf(stderr, "freeing invalid memory (%p)\n", ptr);
 865                 }
 866                 backtrace = backtrace_create(2);
 867                 backtrace->log(backtrace, stderr, TRUE);
 868                 backtrace->destroy(backtrace);
 869         }
 870         else
 871         {
 872                 remove_hdr(hdr);
 873
 874                 hdr->backtrace->destroy(hdr->backtrace);
 875
 876                 /* clear MAGIC, set mem to something remarkable */
 877                 memset(hdr, MEMORY_FREE_PATTERN,
 878                            sizeof(memory_header_t) + hdr->bytes + sizeof(memory_tail_t));
 879
 880                 real_free(hdr);
 881         }
 882         enable_thread(before);
 883 }
 884
 885 /**
 886  * Wrapped realloc() function
 887  */
 888 HOOK(void*, realloc, void *old, size_t bytes)
 889 {
 890         memory_header_t *hdr;
 891         memory_tail_t *tail;
 892         backtrace_t *backtrace;
 893         bool before;
 894
 895         if (!enabled || thread_disabled->get(thread_disabled))
 896         {
 897                 return real_realloc(old, bytes);
 898         }
 899         /* allow reallocation of NULL */
 900         if (old == NULL)
 901         {
 902                 return malloc(bytes);
 903         }
 904         /* handle zero size as a free() */
 905         if (bytes == 0)
 906         {
 907                 free(old);
 908                 return NULL;
 909         }
 910
 911         hdr = old - sizeof(memory_header_t);
 912         tail = old + hdr->bytes;
 913
 914         remove_hdr(hdr);
 915
 916         if (hdr->magic != MEMORY_HEADER_MAGIC ||
 917                 tail->magic != MEMORY_TAIL_MAGIC)
 918         {
 919                 fprintf(stderr, "reallocating invalid memory (%p):\n"
 920                                 "header magic 0x%x:\n", old, hdr->magic);
 921                 backtrace = backtrace_create(2);
 922                 backtrace->log(backtrace, stderr, TRUE);
 923                 backtrace->destroy(backtrace);
 924         }
 925         else
 926         {
 927                 /* clear tail magic, allocate, set tail magic */
 928                 memset(&tail->magic, MEMORY_ALLOC_PATTERN, sizeof(tail->magic));
 929         }
 930         hdr = real_realloc(hdr,
 931                                            sizeof(memory_header_t) + bytes + sizeof(memory_tail_t));
 932         tail = ((void*)hdr) + bytes + sizeof(memory_header_t);
 933         tail->magic = MEMORY_TAIL_MAGIC;
 934
 935         /* update statistics */
 936         hdr->bytes = bytes;
 937
 938         before = enable_thread(FALSE);
 939         hdr->backtrace->destroy(hdr->backtrace);
 940         hdr->backtrace = backtrace_create(2);
 941         enable_thread(before);
 942
 943         add_hdr(hdr);
 944
 945         return hdr + 1;
 946 }
 947
 948 METHOD(leak_detective_t, destroy, void,
 949         private_leak_detective_t *this)
 950 {
 951         disable_leak_detective();
 952         lock->destroy(lock);
 953         thread_disabled->destroy(thread_disabled);
 954         free(this);
 955         first_header.next = NULL;
 956 }
 957
 958 /*
 959  * see header file
 960  */
 961 leak_detective_t *leak_detective_create()
 962 {
 963         private_leak_detective_t *this;
 964
 965         INIT(this,
 966                 .public = {
 967                         .report = _report,
 968                         .set_report_cb = _set_report_cb,
 969                         .usage = _usage,
 970                         .leaks = _leaks,
 971                         .set_state = _set_state,
 972                         .destroy = _destroy,
 973                 },
 974         );
 975
 976         if (getenv("LEAK_DETECTIVE_DISABLE") != NULL)
 977         {
 978                 free(this);
 979                 return NULL;
 980         }
 981
 982         lock = spinlock_create();
 983         thread_disabled = thread_value_create(NULL);
 984
 985         init_static_allocations();
 986
 987         if (register_hooks())
 988         {
 989                 enable_leak_detective();
 990         }
 991         return &this->public;
 992 }