diff --git a/tests/binaries/Makefile b/tests/binaries/Makefile index a05d757c6..009d20a65 100644 --- a/tests/binaries/Makefile +++ b/tests/binaries/Makefile @@ -46,4 +46,6 @@ canary.out: EXTRA_FLAGS := -fstack-protector-all heap-non-main.out heap-tcache.out heap-multiple-heaps.out: EXTRA_FLAGS := -pthread +heap-bins.out: EXTRA_FLAGS := -Wno-unused-result + default.out: EXTRA_FLAGS := -fstack-protector-all -fpie -pie diff --git a/tests/binaries/heap-bins.c b/tests/binaries/heap-bins.c new file mode 100644 index 000000000..b7d14e15d --- /dev/null +++ b/tests/binaries/heap-bins.c @@ -0,0 +1,18 @@ +#include +#include + +#include "utils.h" + +int main(){ + void *small = malloc(0x10); // small chunk + malloc(0x20); // avoid consolidation of chunks + void *large = malloc(0x410); // large chunk + malloc(0x20); // avoid consolidation of chunks + free(small); + free(large); + void *unsorted = malloc(0x420); // make sure the unsorted chunk is bigger than large chunk + malloc(0x420); // sort the freed chunks from unsorted to their corresponding bins + free(unsorted); + DebugBreak(); + return EXIT_SUCCESS; +} diff --git a/tests/runtests.py b/tests/runtests.py index d5d15325c..02d8a0f53 100755 --- a/tests/runtests.py +++ b/tests/runtests.py @@ -291,6 +291,15 @@ def test_cmd_heap_bins_fast(self): self.assertIn("Chunk(addr=", res) return + def test_cmd_heap_bins_large(self): + cmd = "heap bins large" + target = _target("heap-bins") + res = gdb_run_silent_cmd(cmd, target=target) + self.assertNoException(res) + self.assertIn("Found 1 chunks in 1 large non-empty bins", res) + self.assertIn("Chunk(addr=", res) + self.assertIn("size=0x420", res) + def test_cmd_heap_bins_non_main(self): cmd = "python gdb.execute('heap bins fast {}'.format(get_glibc_arena().next))" before = ["set environment GLIBC_TUNABLES glibc.malloc.tcache_count=0"] @@ -300,6 +309,16 @@ def test_cmd_heap_bins_non_main(self): self.assertIn("size=0x20", res) return + def test_cmd_heap_bins_small(self): + cmd = "heap bins small" + before = ["set environment GLIBC_TUNABLES glibc.malloc.tcache_count=0"] + target = _target("heap-bins") + res = gdb_run_silent_cmd(cmd, before=before, target=target) + self.assertNoException(res) + self.assertIn("Found 1 chunks in 1 small non-empty bins", res) + self.assertIn("Chunk(addr=", res) + self.assertIn("size=0x20", res) + def test_cmd_heap_bins_tcache(self): cmd = "heap bins tcache" target = _target("heap-non-main") @@ -319,6 +338,15 @@ def test_cmd_heap_bins_tcache_all(self): self.assertTrue(len(tcachebins_lines) == 2) return + def test_cmd_heap_bins_unsorted(self): + cmd = "heap bins unsorted" + target = _target("heap-bins") + res = gdb_run_silent_cmd(cmd, target=target) + self.assertNoException(res) + self.assertIn("Found 1 chunks in unsorted bin", res) + self.assertIn("Chunk(addr=", res) + self.assertIn("size=0x430", res) + def test_cmd_heap_analysis(self): cmd = "heap-analysis-helper" target = _target("heap-analysis")