array overread/overwrite

(require memcheck)

(defun malloc-max () (+ *malloc-arena-start* *malloc-max-arena-size*))

(defmethod init ()
  (msg "*malloc-arena-start* : $0" *malloc-arena-start*)
  (msg "*malloc-arena-end* : $0" *malloc-arena-end*)
  (msg "*malloc-max-arena-size : $0" *malloc-max-arena-size*)
  (msg "malloc max end : $0" (malloc-max))
  (msg "brk : $0" brk))

(defun out-of-bounds/check (ptr)
  (let ((malloc-lower-bound *malloc-arena-start*)
	(malloc-upper-bound (malloc-max)))
    (when (and
	   (>= ptr malloc-lower-bound)
	   (<= ptr malloc-upper-bound)
	   (not (region-contains 'memcheck/live/malloc ptr)))
      (msg "ptr: $0 malloc-lower-bound: $1 malloc-upper-bound: $2" ptr malloc-lower-bound malloc-upper-bound)
      (msg "out of bounds")
      (incident-report 'out-of-bounds (incident-location)))))

(defmethod loaded (ptr)
  (msg "loaded $0, malloc: [$1..$2]" ptr *malloc-arena-start* brk)
  (out-of-bounds/check ptr))

(defmethod stored (ptr)
  (msg "stored $0, malloc: [$1..$2]" ptr *malloc-arena-start* brk)
  (out-of-bounds/check ptr))