Skip to content

Commit 2d3636b

Browse files
committed
CoreFoundation: correct alignment mis-assumption
The allocator on 32-bit platforms are not guaranteed to provide a 16-byte alignment. This would cause an over-aligned request which would be serviced by a different allocation path which needs to be paired with an appropriate deallocation invocation. Failure to do so resulted in a heap corruption on Windows i686.
1 parent d956aff commit 2d3636b

File tree

1 file changed

+15
-1
lines changed

1 file changed

+15
-1
lines changed

CoreFoundation/Base.subproj/CFRuntime.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -442,7 +442,21 @@ CFTypeRef _CFRuntimeCreateInstance(CFAllocatorRef allocator, CFTypeID typeID, CF
442442
uintptr_t isa = __CFRuntimeObjCClassTable[typeID];
443443
CFIndex size = sizeof(CFRuntimeBase) + extraBytes;
444444
const CFRuntimeClass *cls = __CFRuntimeClassTable[typeID];
445-
size_t align = (cls->version & _kCFRuntimeRequiresAlignment) ? cls->requiredAlignment : 16;
445+
446+
#if !defined(__APPLE__) && (defined(__i686__) || (defined(__arm__) && !defined(__aarch64__)) || defined(_M_IX86) || defined(_M_ARM))
447+
// Linux and Windows 32-bit targets perform 8-byte alignment by default.
448+
static const kDefaultAlignment = 8;
449+
#else
450+
static const kDefaultAlignment = 16;
451+
#endif
452+
453+
// Ensure that we get the alignment correct for various targets. In the
454+
// case that we are over-aligned `swift_allocObject` will go through a
455+
// different allocator to ensure that the pointer is suitably aligned. When
456+
// we subsequently release the pointer we do not tag that release to go
457+
// through the overalign'ed path. This may result in a cross-domainf free
458+
// and a resultant heap corruption.
459+
size_t align = (cls->version & _kCFRuntimeRequiresAlignment) ? cls->requiredAlignment : kDefaultAlignment;
446460

447461
CFRuntimeBase *memory = (CFRuntimeBase *)swift_allocObject(isa, size, align - 1);
448462

0 commit comments

Comments
 (0)