Fix possible issue with cfi_basic test.

It's possible for malloc to return a pointer that is not going to
crash with __cfi_slowpath. It's possible to modify the cfi code
to avoid this problem, but I'm not convinced that this will be any
better at catching problems. So I'm just modifying the test so that
it will eventually allocate a pointer that does not overlap.

This previous version of the test failed on jemalloc svelte config,
but there is nothing that would not result in a failure on scudo
leading to a failure every once in a while.

Bug: 142556796
Bug: 140079007

Test: Ran bionic unit tests with jemalloc and scudo.
Change-Id: Iff45bd950d2eb33ff56dc700a2d739b5b578e090
Merged-In: Iff45bd950d2eb33ff56dc700a2d739b5b578e090
(cherry picked from commit f322483b3f8a6e05db5c3fc7974601032a03ba0a)

1 files changed, 15 insertions, 4 deletions

diff --git a/tests/cfi_test.cpp b/tests/cfi_test.cpp
index e155e1a84..792f917b2 100644
--- a/tests/cfi_test.cpp
+++ b/tests/cfi_test.cpp
@@ -18,6 +18,8 @@
 #include <gtest/gtest.h>
 #include <sys/stat.h>
 
+#include <vector>
+
 #include "BionicDeathTest.h"
 #include "gtest_globals.h"
 #include "utils.h"
@@ -35,6 +37,14 @@ size_t __cfi_shadow_size();
 
 static void f() {}
 
+static void test_cfi_slowpath_with_alloc() {
+  std::vector<void*> allocs;
+  for (size_t i = 0; i < 1000; i++) {
+    allocs.push_back(malloc(4096));
+    __cfi_slowpath(46, allocs.back());
+  }
+}
+
 TEST(cfi_test, basic) {
 #if defined(__BIONIC__)
   void* handle;
@@ -88,10 +98,11 @@ TEST(cfi_test, basic) {
   // CFI check for a stack address. This is always invalid and gets the process killed.
   EXPECT_DEATH(__cfi_slowpath(45, reinterpret_cast<void*>(&c)), "");
 
-  // CFI check for a heap address. This is always invalid and gets the process killed.
-  void* p = malloc(4096);
-  EXPECT_DEATH(__cfi_slowpath(46, p), "");
-  free(p);
+  // CFI check for a heap address.
+  // It's possible that this allocation could wind up in the same CFI granule as
+  // an unchecked library, which means the below might not crash. To force a
+  // crash keep allocating up to a max until there is a crash.
+  EXPECT_DEATH(test_cfi_slowpath_with_alloc(), "");
 
   // Check all the addresses.
   const size_t bss_size = 1024 * 1024;