未验证 提交 205b7fff 编写于 作者: A Andrew Au 提交者: GitHub

Avoid infinite loop in case of heap corruption (#70759)

Co-authored-by: NJuan Hoyos <juan.hoyos@microsoft.com>
Co-authored-by: NNoah Falk <noahfalk@users.noreply.github.com>
上级 446e5ad9
......@@ -6450,7 +6450,7 @@ HRESULT DacHeapWalker::MoveToNextObject()
bool DacHeapWalker::GetSize(TADDR tMT, size_t &size)
{
// With heap corruption, it's entierly possible that the MethodTable
// With heap corruption, it's entirely possible that the MethodTable
// we get is bad. This could cause exceptions, which we will catch
// and return false. This causes the heapwalker to move to the next
// segment.
......@@ -6478,6 +6478,12 @@ bool DacHeapWalker::GetSize(TADDR tMT, size_t &size)
size = AlignLarge(size);
else
size = Align(size);
// If size == 0, it means we have a heap corruption and
// we will stuck in an infinite loop, so better fail the call now.
ret &= (0 < size);
// Also guard for cases where the size reported is too large and exceeds the high allocation mark.
ret &= ((tMT + size) <= mHeaps[mCurrHeap].Segments[mCurrSeg].End);
}
EX_CATCH
{
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册