diff --git a/test/simple-memory-corruption/Makefile b/test/simple-memory-corruption/Makefile new file mode 100644 index 0000000..7ea6e22 --- /dev/null +++ b/test/simple-memory-corruption/Makefile @@ -0,0 +1,11 @@ +all: \ + double_free_large \ + double_free_small \ + unaligned_free_large \ + unaligned_free_small \ + read_after_free_large \ + read_after_free_small \ + write_after_free_large \ + write_after_free_small \ + read_zero_size \ + write_zero_size \ diff --git a/test/simple-memory-corruption/double_free_large.c b/test/simple-memory-corruption/double_free_large.c new file mode 100644 index 0000000..ce4850d --- /dev/null +++ b/test/simple-memory-corruption/double_free_large.c @@ -0,0 +1,12 @@ +#include + +__attribute__((optimize(0))) +int main(void) { + void *p = malloc(128 * 1024); + if (!p) { + return 1; + } + free(p); + free(p); + return 0; +} diff --git a/test/simple-memory-corruption/double_free_small.c b/test/simple-memory-corruption/double_free_small.c new file mode 100644 index 0000000..399b8d0 --- /dev/null +++ b/test/simple-memory-corruption/double_free_small.c @@ -0,0 +1,12 @@ +#include + +__attribute__((optimize(0))) +int main(void) { + void *p = malloc(16); + if (!p) { + return 1; + } + free(p); + free(p); + return 0; +} diff --git a/test/simple-memory-corruption/read_after_free_large.c b/test/simple-memory-corruption/read_after_free_large.c new file mode 100644 index 0000000..81e8628 --- /dev/null +++ b/test/simple-memory-corruption/read_after_free_large.c @@ -0,0 +1,17 @@ +#include +#include +#include + +__attribute__((optimize(0))) +int main(void) { + char *p = malloc(128 * 1024); + if (!p) { + return 1; + } + memset(p, 'a', 16); + free(p); + for (size_t i = 0; i < 128 * 1024; i++) { + printf("%x\n", p[i]); + } + return 0; +} diff --git a/test/simple-memory-corruption/read_after_free_small.c b/test/simple-memory-corruption/read_after_free_small.c new file mode 100644 index 0000000..cc4d154 --- /dev/null +++ b/test/simple-memory-corruption/read_after_free_small.c @@ -0,0 +1,17 @@ +#include +#include +#include + +__attribute__((optimize(0))) +int main(void) { + char *p = malloc(16); + if (!p) { + return 1; + } + memset(p, 'a', 16); + free(p); + for (size_t i = 0; i < 16; i++) { + printf("%x\n", p[i]); + } + return 0; +} diff --git a/test/simple-memory-corruption/read_zero_size.c b/test/simple-memory-corruption/read_zero_size.c new file mode 100644 index 0000000..7e6ed78 --- /dev/null +++ b/test/simple-memory-corruption/read_zero_size.c @@ -0,0 +1,12 @@ +#include +#include + +__attribute__((optimize(0))) +int main(void) { + char *p = malloc(0); + if (!p) { + return 1; + } + printf("%c\n", *p); + return 0; +} diff --git a/test/simple-memory-corruption/unaligned_free_large.c b/test/simple-memory-corruption/unaligned_free_large.c new file mode 100644 index 0000000..3bee868 --- /dev/null +++ b/test/simple-memory-corruption/unaligned_free_large.c @@ -0,0 +1,11 @@ +#include + +__attribute__((optimize(0))) +int main(void) { + char *p = malloc(128 * 1024); + if (!p) { + return 1; + } + free(p + 1); + return 0; +} diff --git a/test/simple-memory-corruption/unaligned_free_small.c b/test/simple-memory-corruption/unaligned_free_small.c new file mode 100644 index 0000000..bf80307 --- /dev/null +++ b/test/simple-memory-corruption/unaligned_free_small.c @@ -0,0 +1,11 @@ +#include + +__attribute__((optimize(0))) +int main(void) { + char *p = malloc(16); + if (!p) { + return 1; + } + free(p + 1); + return 0; +} diff --git a/test/simple-memory-corruption/write_after_free_large.c b/test/simple-memory-corruption/write_after_free_large.c new file mode 100644 index 0000000..f2d30bf --- /dev/null +++ b/test/simple-memory-corruption/write_after_free_large.c @@ -0,0 +1,14 @@ +#include +#include +#include + +__attribute__((optimize(0))) +int main(void) { + char *p = malloc(128 * 1024); + if (!p) { + return 1; + } + free(p); + memset(p, 'a', 128 * 1024); + return 0; +} diff --git a/test/simple-memory-corruption/write_after_free_small.c b/test/simple-memory-corruption/write_after_free_small.c new file mode 100644 index 0000000..bcaa64b --- /dev/null +++ b/test/simple-memory-corruption/write_after_free_small.c @@ -0,0 +1,14 @@ +#include +#include +#include + +__attribute__((optimize(0))) +int main(void) { + char *p = malloc(16); + if (!p) { + return 1; + } + free(p); + memset(p, 'a', 16); + return 0; +} diff --git a/test/simple-memory-corruption/write_zero_size.c b/test/simple-memory-corruption/write_zero_size.c new file mode 100644 index 0000000..def29b5 --- /dev/null +++ b/test/simple-memory-corruption/write_zero_size.c @@ -0,0 +1,12 @@ +#include +#include + +__attribute__((optimize(0))) +int main(void) { + char *p = malloc(0); + if (!p) { + return 1; + } + *p = 5; + return 0; +}