pepyakin
commented
5 years ago FWIW, there are more options for sentiel value:
- A commonly used approach is to use the alignment of the value. One downside of this approach, is that rustc/lld puts stack at the beginning of the linear memory and stack grows downwards. When the stack is about to overflow, then weird things can happen, like the address of a local variable can be equal to the sentiel address of a zero-sized allocation. I am not sure if this should be a concern, since the probability of experiencing this issue is really low: e.g. reference equality is not common in rust, this happens only if the stack is about to overflow but it doesn't overflow, the compared values should align correctly, etc. Moreover, UB can be spawn if the address of the last word on the stack (i.e. 0 aka NULL), so this is not a big stretch. Nevertheless, if we decide to go with this approach, a comment on this should be left to greatly relief the lives of the auditors.
- We can use 0 value for the sentiel. In this case, we would need to change our
GlobalAllocimplementation, since returning NULL pointer from there denotes OOM condition and thus will lead to abort and panic which is not desirable since 0-allocation is pretty legit. Besides that, sometimes we return pointers to the allocated data from the Substrate Runtime Interfae host, so we need to ensure that these values are not used for things likefrom_raw_partsor similar. - We can allocate 8 bytes (or however many we use for overaligning) at the beginning of the heap and use that as a special sentiel value.
ghost
cmichi
bkchr
Escalated from the discussion here.
Right now the allocator always uses at least 8 bytes when allocating (see here), even when
alloc(0)is called. Instead the case of zero-sized allocations should be handled specially, without actually allocating space (which is done at the moment).One idea to explore is to return a "sentinel pointer"; something like
sentinel_ptr = align_to_8_bytes(max_heap_size + 1)would be guaranteed to not be a valid pointer and could be used.deallocneeds to be aware of this "sentinel pointer" and handle it specially (by not actually freeing).If you want to work on this, it's best to talk to @pepyakin for more details.