The Structure of a Page Heap Block

  • Article

When full page heap is enabled, guard pages are used and buffer overrun/underrun are caught instantly as the program will access violate at the point of overrun/underrun. These failures are easy to debug because the current stack trace points directly to the broken code. If normal page heap is used or the corruption happens in the small fill pattern at end of buffer for alignment reasons the corruption will be detected only when the block is freed. In these cases more involved detective techniques are required. To make life easier in such cases the page heap manager places a header before all allocations (full and normal). This header contains a few valuable bits of information (owning heap, user requested size and stack trace for the allocation in some cases). The structure of the full and normal page heap blocks is described below.

Normal page heap block structure

nphbs

Full page heap block structure

fphbs

The information block has the following structure:

DPH_BLOCK_INFORMATION

ULONG         StartStamp;

PVOID         Heap;

SIZE_T        RequestedSize;

SIZE_T        ActualSize;

LIST_ENTRY    FreeQueue;

PVOID         StackTrace;

ULONG         EndStamp;

The Heap field stores the owning heap. The user requested size for the block is in RequestedSize. The stack trace address is stored in the stack trace field.

The StackTrace field will not always contain a non-null value for various reasons. First of all stack trace detection is supported only on x86 platforms and second, even on x86 machines the stack trace detection algorithms are not completely reliable. If the block is an allocated block the stack trace is for the allocation moment. If the block was freed, the stack trace is for the free moment.