Merge pull request #2755 from rainers/structinfo_lifetime

Issue 20155 - Allocating a struct with dtor on the GC heap can produce false pointers
merged-on-behalf-of: Nicholas Wilson <thewilsonator@users.noreply.github.com>

Author: dlang-bot

src/rt/lifetime.d

@@ -406,6 +406,22 @@ size_t __arrayPad(size_t size, const TypeInfo tinext) nothrow pure @trusted
     return size > MAXMEDSIZE ? LARGEPAD : ((size > MAXSMALLSIZE ? MEDPAD : SMALLPAD) + structTypeInfoSize(tinext));
 }
 
+/**
+  clear padding that might not be zeroed by the GC (it assumes it is within the
+  requested size from the start, but it is actually at the end of the allocated block)
+  */
+private void __arrayClearPad(ref BlkInfo info, size_t arrsize, size_t padsize) nothrow pure
+{
+    import core.stdc.string;
+    if (padsize > MEDPAD && !(info.attr & BlkAttr.NO_SCAN) && info.base)
+    {
+        if (info.size < PAGESIZE)
+            memset(info.base + arrsize, 0, padsize);
+        else
+            memset(info.base, 0, LARGEPREFIX);
+    }
+}
+
 /**
   allocate an array memory block by applying the proper padding and
   assigning block attributes if not inherited from the existing block
@@ -426,7 +442,10 @@ BlkInfo __arrayAlloc(size_t arrsize, const TypeInfo ti, const TypeInfo tinext) n
     uint attr = (!(tinext.flags & 1) ? BlkAttr.NO_SCAN : 0) | BlkAttr.APPENDABLE;
     if (typeInfoSize)
         attr |= BlkAttr.STRUCTFINAL | BlkAttr.FINALIZE;
-    return GC.qalloc(padded_size, attr, tinext);
+
+    auto bi = GC.qalloc(padded_size, attr, tinext);
+    __arrayClearPad(bi, arrsize, padsize);
+    return bi;
 }
 
 BlkInfo __arrayAlloc(size_t arrsize, ref BlkInfo info, const TypeInfo ti, const TypeInfo tinext)
@@ -436,14 +455,17 @@ BlkInfo __arrayAlloc(size_t arrsize, ref BlkInfo info, const TypeInfo ti, const
     if (!info.base)
         return __arrayAlloc(arrsize, ti, tinext);
 
+    immutable padsize = __arrayPad(arrsize, tinext);
     bool overflow;
-    auto padded_size = addu(arrsize, __arrayPad(arrsize, tinext), overflow);
+    auto padded_size = addu(arrsize, padsize, overflow);
     if (overflow)
     {
         return BlkInfo();
     }
 
-    return GC.qalloc(padded_size, info.attr, tinext);
+    auto bi = GC.qalloc(padded_size, info.attr, tinext);
+    __arrayClearPad(bi, arrsize, padsize);
+    return bi;
 }
 
 /**
@@ -1096,15 +1118,19 @@ extern (C) void* _d_newitemU(in TypeInfo _ti)
     auto ti = unqualify(_ti);
     auto flags = !(ti.flags & 1) ? BlkAttr.NO_SCAN : 0;
     immutable tiSize = structTypeInfoSize(ti);
-    immutable size = ti.tsize + tiSize;
+    immutable itemSize = ti.tsize;
+    immutable size = itemSize + tiSize;
     if (tiSize)
         flags |= BlkAttr.STRUCTFINAL | BlkAttr.FINALIZE;
 
     auto blkInf = GC.qalloc(size, flags, ti);
     auto p = blkInf.base;
 
     if (tiSize)
+    {
+        *cast(TypeInfo*)(p + itemSize) = null; // the GC might not have cleared this area
         *cast(TypeInfo*)(p + blkInf.size - tiSize) = cast() ti;
+    }
 
     return p;
 }
@@ -2678,6 +2704,80 @@ deprecated unittest
     }
 }
 
+// test struct dtor handling not causing false pointers
+unittest
+{
+    if (!callStructDtorsDuringGC)
+        return;
+
+    // for 64-bit, allocate a struct of size 40
+    static struct S
+    {
+        size_t[4] data;
+        S* ptr4;
+    }
+    auto p1 = new S;
+    auto p2 = new S;
+    p2.ptr4 = p1;
+
+    // a struct with a dtor with size 32, but the dtor will cause
+    //  allocation to be larger by a pointer
+    static struct A
+    {
+        size_t[3] data;
+        S* ptr3;
+
+        ~this() {}
+    }
+
+    GC.free(p2);
+    auto a = new A; // reuse same memory
+    if (cast(void*)a is cast(void*)p2) // reusage not guaranteed
+    {
+        auto ptr = cast(S**)(a + 1);
+        assert(*ptr != p1); // still same data as p2.ptr4?
+    }
+
+    // small array
+    static struct SArr
+    {
+        void*[10] data;
+    }
+    auto arr1 = new SArr;
+    arr1.data[] = p1;
+    GC.free(arr1);
+
+    // allocates 2*A.sizeof + (void*).sizeof (TypeInfo) + 1 (array length)
+    auto arr2 = new A[2];
+    if (cast(void*)arr1 is cast(void*)arr2.ptr) // reusage not guaranteed
+    {
+        auto ptr = cast(S**)(arr2.ptr + 2);
+        assert(*ptr != p1); // still same data as p2.ptr4?
+    }
+
+    // large array
+    static struct LArr
+    {
+        void*[1023] data;
+    }
+    auto larr1 = new LArr;
+    larr1.data[] = p1;
+    GC.free(larr1);
+
+    auto larr2 = new S[255];
+    if (cast(void*)larr1 is cast(void*)larr2.ptr - LARGEPREFIX) // reusage not guaranteed
+    {
+        auto ptr = cast(S**)larr1;
+        assert(ptr[0] != p1); // 16 bytes array header
+        assert(ptr[1] != p1);
+        version (D_LP64) {} else
+        {
+            assert(ptr[2] != p1);
+            assert(ptr[3] != p1);
+        }
+    }
+}
+
 // test class finalizers exception handling
 unittest
 {