ziglang/zig

Fork 757

Code Issues 691 Pull requests 282 Activity Actions 22

Enhance `DebugAllocator` to catch Use-After-Frees #35894

New issue

Closed

opened 2026年06月22日 19:49:26 +02:00 by cozis · 5 comments

cozis commented

2026年06月22日 19:49:26 +02:00

Copy link

I recently found an use-after-free in opentelemetry-zig that flew under the radar because DebugAllocator has no way to poison unused memory slots. The bug in question triggered reliably when switching to a page_allocator since it immediately unmaps pages associated to an allocation upon freeing.

I found this somewhat unintuitive as I needed to switch away from DebugAllocator to find the bug. Does it make sense to modify the DebugAllocator in order to catch this type of issues?

If so, there are 2 ways I see this could be done:

Add a configuration that causes DebugAllocator to behave similarly to page_allocator
Annotate memory regions as unreachable using the APIs in std.valgrind.memcheck. This is less intrusive but only works when running the program under valgrind

It's also worth noting that address sanitizer has an API to poison arbitrary memory regions with a granularity of 8 bytes, but I'm assuming that would be much more involved.

Cheers!

I recently found an use-after-free in [opentelemetry-zig](https://github.com/open-telemetry/opentelemetry-zig/issues/29) that flew under the radar because `DebugAllocator` has no way to poison unused memory slots. The bug in question triggered reliably when switching to a `page_allocator` since it immediately unmaps pages associated to an allocation upon freeing. I found this somewhat unintuitive as I needed to switch away from `DebugAllocator` to find the bug. Does it make sense to modify the `DebugAllocator` in order to catch this type of issues? If so, there are 2 ways I see this could be done: 1. Add a configuration that causes `DebugAllocator` to behave similarly to `page_allocator` 2. Annotate memory regions as unreachable using the APIs in `std.valgrind.memcheck`. This is less intrusive but only works when running the program under valgrind It's also worth noting that address sanitizer has an API to poison arbitrary memory regions with a granularity of 8 bytes, but I'm assuming that would be much more involved. Cheers!

1off commented

2026年06月22日 19:59:55 +02:00

Contributor

Copy link

Relevant #31991

Relevant https://codeberg.org/ziglang/zig/pulls/31991

nektro commented

2026年06月22日 20:26:00 +02:00

Contributor

Copy link

~~(削除) Duplicate #35893 (削除ここまで)~~

~~Duplicate https://codeberg.org/ziglang/zig/issues/35893~~

nektro commented

2026年06月22日 20:27:12 +02:00

Contributor

Copy link

👍 1

cozis commented

2026年06月22日 21:08:05 +02:00

Author

Copy link

Thanks for the link. I should add that adding Valgrind annotations helps beyond this specific issue as it allows to correctly report memory leaks in relation to custom allocator interfaces.

There is also the option to use page_allocator when this matters, but then writing tests with std.heap.page_allocator instead of std.testing.allocator would be a bit strange

Thanks for the link. I should add that adding Valgrind annotations helps beyond this specific issue as it allows to correctly report memory leaks in relation to custom allocator interfaces. There is also the option to use page_allocator when this matters, but then writing tests with `std.heap.page_allocator` instead of `std.testing.allocator` would be a bit strange

andrewrk added the

lib/std

label

2026年06月22日 21:10:30 +02:00

andrewrk added this to the Post-1.0 milestone

2026年06月22日 21:10:31 +02:00

andrewrk added the

enhancement

label

2026年06月22日 21:10:56 +02:00

andrewrk commented

2026年06月22日 21:12:17 +02:00

Owner

Copy link

I don't think the idea of swapping out the behavior of DebugAllocator from inside makes sense. That logic belongs outside the implementation. Applications can already choose to do that.

Valgrind integration is already done in the Allocator interface via @memset to undefined.

SafeAllocator already prevents UAF bugs by avoiding reusing memory for subsequent allocations and setting deallocated memory to undefined. You got a segfault thanks to this safety. Segfaults are good, they are safety.

I don't think the idea of swapping out the behavior of DebugAllocator from inside makes sense. That logic belongs outside the implementation. Applications can already choose to do that. Valgrind integration is already done in the Allocator interface via `@memset` to `undefined`. SafeAllocator already prevents UAF bugs by avoiding reusing memory for subsequent allocations and setting deallocated memory to undefined. You got a segfault thanks to this safety. Segfaults are good, they are safety.

andrewrk

2026年06月22日 21:12:37 +02:00

closed this issue
removed the
enhancement
label

andrewrk removed this from the Post-1.0 milestone

2026年06月22日 21:12:45 +02:00

andrewrk added

question

and removed

lib/std

labels

2026年06月22日 21:12:55 +02:00

No Branch/Tag specified

Branches Tags

master

elfv2

spork8

restricted

0.16.x

panic-rewrite

parking-futex-lockfree

windows-Io-cleanup

Io-watch

ParseCommandLineOptions

windows-async-files

poll-ring

debug-file-leaks-differently

debug-file-leaks

ProcessPrng

elfv2-dyn

jobserver

threadtheft

io-threaded-no-queue

0.15.x

Io.net

comptime-allocator

restricted-function-pointers

cli

wasm-linker-writer

wrangle-writer-buffering

sha1-stream

async-await-demo

fixes

0.14.x

ast-node-methods

macos-debug-info

make-vs-configure

fuzz-macos

sans-aro

ArrayList-reserve

incr-bug

llvm-ir-nosanitize-metadata

ci-tarballs

ci-scripts

threadpool

0.12.x

new-pkg-hash

json-diagnostics

more-doctests

rework-comptime-mutation

0.11.x

ci-perf-comment

stage2-async

0.10.x

autofix

0.9.x

aro

hcs

0.8.x

0.7.x

Labels

Clear labels

This proposal is planned.

The web application for interactive documentation and generation of its assets.

backend/c

The C backend outputs C source code.

backend/llvm

The LLVM backend outputs an LLVM bitcode module.

backend/self-hosted

The self-hosted backends produce machine code directly.

binutils

Zig's included binary utilities: zig ar, zig dlltool, zig lib, zig ranlib, zig objcopy, and zig rc.

breaking

Implementing this issue could cause existing code to no longer compile or have different behavior.

build system

The Zig build system - zig build, std.Build, the build runner, and package management.

debug info

docs

An issue with documentation, e.g. the language reference or standard library doc comments.

error message

This issue points out an error message that is unhelpful and should be improved.

frontend

Tokenization, parsing, AstGen, ZonGen, Sema, Legalize, and Liveness.

fuzzing

incremental

Reuse of internal compiler state for faster compilation.

lib/c

This issue relates to Zig's libc implementation and/or vendored libcs.

lib/compiler-rt

This issue relates to Zig's compiler-rt library.

lib/cxx

This issue relates to Zig's vendored libc++ and/or libc++abi.

lib/std

This issue relates to Zig's standard library.

lib/tsan

This issue relates to Zig's vendored libtsan.

lib/ubsan-rt

This issue relates to Zig's ubsan-rt library.

lib/unwind

This issue relates to Zig's vendored libunwind.

linking

Zig's integrated object file and incremental linker.

miscompilation

The compiler reports success but produces semantically incorrect code.

This issue suggests language modifications. If it also has the "accepted" label then it is planned.

release notes

This issue or pull request should be mentioned in the release notes.

testing

This issue is related to testing the compiler, standard library, or other parts of Zig.

zig cc

Zig as a drop-in C-family compiler.

zig fmt

The Zig source code formatter.

zig reduce

The Zig source code reduction tool.

bounty

https://ziglang.org/news/announcing-donor-bounties

bug

Observed behavior contradicts documented or intended behavior.

contributor-friendly

This issue is limited in scope and/or knowledge of project internals.

downstream

An issue with a third-party project that uses this project.

enhancement

Solving this issue will likely involve adding new logic or components to the codebase.

infra

optimization

A task to improve performance and/or resource usage.

question

No questions on the issue tracker; use a community space instead.

regression

Something that used to work in a previous version stopped working

upstream

An issue with a third-party project that this project uses.

use case

Describes a real use case that is difficult or impossible, but does not propose a solution.

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

4 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ziglang/zig#35894

No description provided.

Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?

Enhance DebugAllocator to catch Use-After-Frees #35894

Enhance `DebugAllocator` to catch Use-After-Frees #35894