Double Free Memory

[ElevationsRPG]

Describe the bug

When this function is called it causes a double free: (Taken from examples\using_bodies_in_chunks\simple_request.cc)

static void logCb(void *data, const void *ruleMessagev) {
    if (ruleMessagev == NULL) {
        std::cout << "I've got a call but the message was null ;(";
        std::cout << std::endl;
        return;
    }

    const modsecurity::RuleMessage *ruleMessage = \
        reinterpret_cast<const modsecurity::RuleMessage *>(ruleMessagev);

    std::cout << "Rule Id: " << std::to_string(ruleMessage->m_rule.m_ruleId);
    std::cout << " phase: " << std::to_string(ruleMessage->getPhase());
    std::cout << std::endl;
    if (ruleMessage->m_isDisruptive) {
        std::cout << " * Disruptive action: ";
        std::cout << modsecurity::RuleMessage::log(*ruleMessage);
        std::cout << std::endl;
        std::cout << " ** %d is meant to be informed by the webserver.";
        std::cout << std::endl;
    } else {
        std::cout << " * Match, but no disruptive action: ";
        std::cout << modsecurity::RuleMessage::log(*ruleMessage);
        std::cout << std::endl;
    }
}

Logs and dumps

WebServerHoster.exe!_mi_page_ptr_unalign(const mi_page_s * page, const void * p) Line 68 C
WebServerHoster.exe!mi_free_generic_mt(mi_page_s * page, mi_segment_s * segment, void * p) Line 96 C
WebServerHoster.exe!mi_free(void * p) Line 172 C
WebServerHoster.exe!mi_free_size(void * p, unsigned __int64 size) Line 355 C
WebServerHoster.exe!operator delete(void * p, unsigned __int64 n) Line 47 C++
[External Code]
WebServerHoster.exe!logCb(void * data, const void * ruleMessagev) Line 89 C++
[External Code]
WebServerHoster.exe!HttpSession::handlerequestSSL(std::string request) Line 1562 C++
WebServerHoster.exe!HttpSession::recievebytes() Line 194 C++
WebServerHoster.exe!startServerHTTPS(int port, ssl_ctx_st * sslContext) Line 1697 C++
[External Code]

To Reproduce

Send a request with no host header via curl:

e.g

curl -H "Host:" http://localhost

Expected behavior

It should log without double freeing

Rule Set (please complete the following information):

Running coreruleset-4.19.0

Additional context

Not sure if the double free happens without sending no host header also this function:

modsecurity::RuleMessage::log(*ruleMessage);

IS the function that explicitly called double free in my crash log.

[airween]

Hi @ElevationsRPG,

thanks for sharing this.

Based on your stack I'm afraid the double free happens not in the library, but the application what embeds it.

WebServerHoster.exe!_mi_page_ptr_unalign(const mi_page_s * page, const void * p) Line 68 C
WebServerHoster.exe!mi_free_generic_mt(mi_page_s * page, mi_segment_s * segment, void * p) Line 96 C
WebServerHoster.exe!mi_free(void * p) Line 172 C
WebServerHoster.exe!mi_free_size(void * p, unsigned __int64 size) Line 355 C

probably in function _mi_page_ptr_unalign().

Without seeing the embedding code I'm afraid I can't help here.

[ElevationsRPG]

Hi @ElevationsRPG,

thanks for sharing this.

Based on your stack I'm afraid the double free happens not in the library, but the application what embeds it.

WebServerHoster.exe!_mi_page_ptr_unalign(const mi_page_s * page, const void * p) Line 68 C
WebServerHoster.exe!mi_free_generic_mt(mi_page_s * page, mi_segment_s * segment, void * p) Line 96 C
WebServerHoster.exe!mi_free(void * p) Line 172 C
WebServerHoster.exe!mi_free_size(void * p, unsigned __int64 size) Line 355 C

probably in function _mi_page_ptr_unalign().

Without seeing the embedding code I'm afraid I can't help here.

Hi airween

Thanks for the quick response and for looking at the stack trace.

I appreciate your assessment; however, I believe the issue may be different than a standard application-level double-free, and I wanted to add some critical context:

The functions listed (_mi_page_ptr_unalign, mi_free_generic_mt, mi_free, etc.) are all internal to the mimalloc library, which is embedded directly into my executable, WebServerHoster.exe.

Crucially, I am compiling mimalloc with the MI_SECURE flag enabled.

The Implication of MI_SECURE
When MI_SECURE is active, mimalloc includes enhanced integrity checks, including:

Double-Free Detection: It checks if a pointer being freed is currently marked as already freed.

Pointer Validity Checks: It verifies that the pointer belongs to a valid mimalloc page.

The failure is occurring deep inside the mimalloc implementation (_mi_page_ptr_unalign and mi_free_generic_mt), which is where these safety checks reside.

My Working Hypothesis
Given that the issue arises in this secure environment, my hypothesis is:

The application code is freeing a pointer once.

The subsequent crash in mi_free_generic_mt is mimalloc's internal reaction to a detected failure (either an already-freed marker or a corrupted pointer/metadata), rather than the application itself calling free() twice.

I'm checking the surrounding application code carefully for memory corruption that could be overwriting mimalloc's metadata, but I wanted to make sure you were aware that this entire stack trace originates within the mimalloc runtime, operating under the highly assertive MI_SECURE flag.

Here is the embedded code you requested for further analysis:

// Adjust a block that was allocated aligned, to the actual start of the block in the page.
// note: this can be called from `mi_free_generic_mt` where a non-owning thread accesses the
// `page_start` and `block_size` fields; however these are constant and the page won't be
// deallocated (as the block we are freeing keeps it alive) and thus safe to read concurrently.
mi_block_t* _mi_page_ptr_unalign(const mi_page_t* page, const void* p) {
  mi_assert_internal(page!=NULL && p!=NULL);

  size_t diff = (uint8_t*)p - page->page_start;
  size_t adjust;
  if mi_likely(page->block_size_shift != 0) {
    adjust = diff & (((size_t)1 << page->block_size_shift) - 1);
  }
  else {
    adjust = diff % mi_page_block_size(page);
  }

  return (mi_block_t*)((uintptr_t)p - adjust);
}

// free a pointer owned by another thread (page parameter comes first for better codegen)
static void mi_decl_noinline mi_free_generic_mt(mi_page_t* page, mi_segment_t* segment, void* p) mi_attr_noexcept {
  mi_block_t* const block = _mi_page_ptr_unalign(page, p); // don't check `has_aligned` flag to avoid a race (issue #865)
  mi_block_check_unguard(page, block, p);
  mi_free_block_mt(page, segment, block);
}

// Free a block
// Fast path written carefully to prevent register spilling on the stack
void mi_free(void* p) mi_attr_noexcept
{
  mi_segment_t* const segment = mi_checked_ptr_segment(p,"mi_free");
  if mi_unlikely(segment==NULL) return;

  const bool is_local = (_mi_prim_thread_id() == mi_atomic_load_relaxed(&segment->thread_id));
  mi_page_t* const page = _mi_segment_page_of(segment, p);

  if mi_likely(is_local) {                        // thread-local free?
    if mi_likely(page->flags.full_aligned == 0) { // and it is not a full page (full pages need to move from the full bin), nor has aligned blocks (aligned blocks need to be unaligned)
      // thread-local, aligned, and not a full page
      mi_block_t* const block = (mi_block_t*)p;
      mi_free_block_local(page, block, true /* track stats */, false /* no need to check if the page is full */);
    }
    else {
      // page is full or contains (inner) aligned blocks; use generic path
      mi_free_generic_local(page, segment, p);
    }
  }
  else {
    // not thread-local; use generic path
    mi_free_generic_mt(page, segment, p);
  }
}

// ------------------------------------------------------
// Free variants
// ------------------------------------------------------

void mi_free_size(void* p, size_t size) mi_attr_noexcept {
  MI_UNUSED_RELEASE(size);
  #if MI_DEBUG
  const size_t available = _mi_usable_size(p,"mi_free_size");
  mi_assert(p == NULL || size <= available || available == 0 /* invalid pointer */ );
  #endif
  mi_free(p);
}

My Transaction logic inside: > WebServerHoster.exe!HttpSession::handlerequestSSL(std::string request) Line 1562 C++

modsecurity::Transaction* transaction = new modsecurity::Transaction(modsec, rules, NULL);
process_intervention(transaction, log);

std::string rawip;

if (cloudflareip.empty())
{
    rawip = this->ipaddress;
}
else
{
    rawip = cloudflareip;
}

transaction->processConnection(rawip.c_str(), 12345, "127.0.0.1", 80);
if (process_intervention(transaction, log))
{
    serveFileSSL("./htdocs/403.shtml");//
    if (transaction)
    {
        delete transaction;
        transaction = nullptr;
    }
    return;
}

transaction->processURI(path.c_str(), method.c_str(), "1.1");
if (process_intervention(transaction, log))
{
    serveFileSSL("./htdocs/403.shtml");
    if (transaction)
    {
        delete transaction;
        transaction = nullptr;
    }
    return;
}

for (auto header : headers)
{
    transaction->addRequestHeader(header.first.c_str(),
        header.second.c_str());
}

if (process_intervention(transaction, log))
{
    serveFileSSL("./htdocs/403.shtml");
    if (transaction)
    {
        delete transaction;
        transaction = nullptr;
    }
    return;
}

transaction->processRequestHeaders();
if (process_intervention(transaction, log))
{
    serveFileSSL("./htdocs/403.shtml");
    if (transaction)
    {
        delete transaction;
        transaction = nullptr;
    }
    return;
}

size_t body_len = request_body.size();

transaction->appendRequestBody(
    (const unsigned char*)request_body.c_str(),
    body_len);

if (process_intervention(transaction, log))
{
    serveFileSSL("./htdocs/403.shtml");
    if (transaction)
    {
        delete transaction;
        transaction = nullptr;
    }
    return;
}

transaction->processRequestBody();
if (process_intervention(transaction, log))
{
    serveFileSSL("./htdocs/403.shtml");
    if (transaction)
    {
        delete transaction;
        transaction = nullptr;
    }
    return;
}

if (transaction)
{
    delete transaction;
    transaction = nullptr;
}

My Initialization in WinMain:

const char* crs_setup_conf = "./coreruleset-4.20.0/crs-setup.conf";  // Path to crs-setup.conf

// List of rule files to load
const std::vector<const char*> rule_files = {
"./coreruleset-4.20.0/modsecurity.conf",
"./coreruleset-4.20.0/crs-setup.conf",

// REQUEST PHASE
"./coreruleset-4.20.0/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example",
"./coreruleset-4.20.0/rules/REQUEST-901-INITIALIZATION.conf",
"./coreruleset-4.20.0/rules/REQUEST-905-COMMON-EXCEPTIONS.conf",
"./coreruleset-4.20.0/rules/REQUEST-911-METHOD-ENFORCEMENT.conf",
"./coreruleset-4.20.0/rules/REQUEST-913-SCANNER-DETECTION.conf",
"./coreruleset-4.20.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf",
"./coreruleset-4.20.0/rules/REQUEST-921-PROTOCOL-ATTACK.conf",
"./coreruleset-4.20.0/rules/REQUEST-922-MULTIPART-ATTACK.conf",
"./coreruleset-4.20.0/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf",
"./coreruleset-4.20.0/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf",
"./coreruleset-4.20.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf",
"./coreruleset-4.20.0/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf",
"./coreruleset-4.20.0/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf",
"./coreruleset-4.20.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf",
"./coreruleset-4.20.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf",
"./coreruleset-4.20.0/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf",
"./coreruleset-4.20.0/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
"./coreruleset-4.20.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf",

// RESPONSE PHASE
"./coreruleset-4.20.0/rules/RESPONSE-950-DATA-LEAKAGES.conf",
"./coreruleset-4.20.0/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf",
"./coreruleset-4.20.0/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf",
"./coreruleset-4.20.0/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf",
"./coreruleset-4.20.0/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf",
"./coreruleset-4.20.0/rules/RESPONSE-955-WEB-SHELLS.conf",
"./coreruleset-4.20.0/rules/RESPONSE-956-DATA-LEAKAGES-RUBY.conf", // Included the missing Ruby file
"./coreruleset-4.20.0/rules/RESPONSE-959-BLOCKING-EVALUATION.conf",
"./coreruleset-4.20.0/rules/RESPONSE-980-CORRELATION.conf",
"./coreruleset-4.20.0/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example"
};

int ret;
const char* error = NULL;

modsec = modsecurity::msc_init();

modsec->setConnectorInformation("ModSecurity-test v0.0.1-alpha" \
    " (ModSecurity test)");
modsec->setServerLogCb(logCb, modsecurity::RuleMessageLogProperty
    | modsecurity::IncludeFullHighlightLogProperty);

rules = modsecurity::msc_create_rules_set();

// Load each rule file
for (const char* rule_file : rule_files) {
    ret = modsecurity::msc_rules_add_file(rules, rule_file, &error);
    if (ret < 0) {
        fprintf(stderr, "Problems loading rule file: %s\n", rule_file);
        fprintf(stderr, "%s\n", error);
        system("pause");
    }
}
modsecurity::msc_rules_dump(rules);

I would also like to add that i was only able to reproduce this crash when sending a request with no host header.

[airween]

Thanks for the detailed report - I can check that only later, it takes some time.

Thanks again.

[airween]

To speed up the investigation, could you share a more usable example what I can "just" compile and run the test?

As I see mimalloc exists on Debian too.

If the code contains any sensitive information, please send that to modsecurity at owasp dot org e-mail address.

[ElevationsRPG]

To speed up the investigation, could you share a more usable example what I can "just" compile and run the test?

As I see mimalloc exists on Debian too.

If the code contains any sensitive information, please send that to modsecurity at owasp dot org e-mail address.

Sure thing no problem Here is a full Reproducible crash example. (Main.cpp) and stack trace working:

The Stacktrace in the working Example:

 	CrashExample.exe!mi_free(void * p) Line 157	C
 	[Inline Frame] CrashExample.exe!mi_free_size(void *) Line 355	C++
 	[Inline Frame] CrashExample.exe!operator delete(void *) Line 47	C++
 	[Inline Frame] CrashExample.exe!std::_Deallocate(void * _Ptr, unsigned __int64 _Bytes) Line 289	C++
>	[Inline Frame] CrashExample.exe!std::allocator<char>::deallocate(char * const) Line 985	C++
 	[Inline Frame] CrashExample.exe!std::string::_Deallocate_for_capacity(std::allocator<char> &) Line 852	C++
 	[Inline Frame] CrashExample.exe!std::string::_Tidy_deallocate() Line 3086	C++
 	[Inline Frame] CrashExample.exe!std::string::{dtor}() Line 1383	C++
 	CrashExample.exe!logCb(void * data, const void * ruleMessagev) Line 42	C++
 	[External Code]	
 	CrashExample.exe!main() Line 210	C++
 	[External Code]	

The Working Example Main.cpp

// CrashExample.cpp : This file contains the 'main' function. Program execution begins and ends there.
//

#include <mimalloc.h>
#include <mimalloc-new-delete.h>//TRY OUT MIMALLOC

#include <modsecurity/modsecurity.h>
#include <modsecurity/rules_set.h>
#include <modsecurity/rule_message.h>

#include <iostream>
#include <vector>
#include <string>
#include <map>

modsecurity::ModSecurity* modsec = NULL;
modsecurity::Transaction* transaction = NULL;
modsecurity::RulesSet* rules = NULL;

static void logCb(void* data, const void* ruleMessagev) {
    if (ruleMessagev == NULL) {
        std::cout << "I've got a call but the message was null ;(";
        std::cout << std::endl;
        return;
    }

    const modsecurity::RuleMessage* ruleMessage = \
        reinterpret_cast<const modsecurity::RuleMessage*>(ruleMessagev);

    std::cout << "Rule Id: " << std::to_string(ruleMessage->m_rule.m_ruleId);
    std::cout << " phase: " << std::to_string(ruleMessage->getPhase());
    std::cout << std::endl;
    if (ruleMessage->m_isDisruptive) {
        std::cout << " * Disruptive action: ";
        std::cout << modsecurity::RuleMessage::log(*ruleMessage);
        std::cout << std::endl;
        std::cout << " ** %d is meant to be informed by the webserver.";
        std::cout << std::endl;
    }
    else {
        std::cout << " * Match, but no disruptive action: ";
        std::cout << modsecurity::RuleMessage::log(*ruleMessage);
        std::cout << std::endl;
    }
}

int process_intervention(modsecurity::Transaction* transaction, std::string &log) {
    modsecurity::ModSecurityIntervention intervention;
    intervention.status = 200;
    intervention.url = NULL;
    intervention.log = NULL;
    intervention.disruptive = 0;

    if (msc_intervention(transaction, &intervention) == 0) {
        return 0;
    }

    if (intervention.log == NULL) {
        intervention.log = _strdup("(no log message was specified)");
    }

    std::cout << "Log: " << intervention.log << std::endl;

    log = intervention.log;

    free(intervention.log);
    intervention.log = NULL;

    if (intervention.url != NULL) {
        std::cout << "Intervention, redirect to: " << intervention.url;
        std::cout << " with status code: " << intervention.status << std::endl;
        free(intervention.url);
        intervention.url = NULL;
        return intervention.status;
    }

    if (intervention.status != 200) {
        std::cout << "Intervention, returning code: " << intervention.status;
        std::cout << std::endl;
        return intervention.status;
    }

    return 0;
}

int main()
{
    const char* crs_setup_conf = "./coreruleset-4.20.0/crs-setup.conf";  // Path to crs-setup.conf

    // List of rule files to load
    const std::vector<const char*> rule_files = {
    "./coreruleset-4.20.0/modsecurity.conf",
    "./coreruleset-4.20.0/crs-setup.conf",

    // REQUEST PHASE
    "./coreruleset-4.20.0/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example",
    "./coreruleset-4.20.0/rules/REQUEST-901-INITIALIZATION.conf",
    "./coreruleset-4.20.0/rules/REQUEST-905-COMMON-EXCEPTIONS.conf",
    "./coreruleset-4.20.0/rules/REQUEST-911-METHOD-ENFORCEMENT.conf",
    "./coreruleset-4.20.0/rules/REQUEST-913-SCANNER-DETECTION.conf",
    "./coreruleset-4.20.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf",
    "./coreruleset-4.20.0/rules/REQUEST-921-PROTOCOL-ATTACK.conf",
    "./coreruleset-4.20.0/rules/REQUEST-922-MULTIPART-ATTACK.conf",
    "./coreruleset-4.20.0/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf",
    "./coreruleset-4.20.0/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf",
    "./coreruleset-4.20.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf",
    "./coreruleset-4.20.0/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf",
    "./coreruleset-4.20.0/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf",
    "./coreruleset-4.20.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf",
    "./coreruleset-4.20.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf",
    "./coreruleset-4.20.0/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf",
    "./coreruleset-4.20.0/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
    "./coreruleset-4.20.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf",

    // RESPONSE PHASE
    "./coreruleset-4.20.0/rules/RESPONSE-950-DATA-LEAKAGES.conf",
    "./coreruleset-4.20.0/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf",
    "./coreruleset-4.20.0/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf",
    "./coreruleset-4.20.0/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf",
    "./coreruleset-4.20.0/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf",
    "./coreruleset-4.20.0/rules/RESPONSE-955-WEB-SHELLS.conf",
    "./coreruleset-4.20.0/rules/RESPONSE-956-DATA-LEAKAGES-RUBY.conf", // Included the missing Ruby file
    "./coreruleset-4.20.0/rules/RESPONSE-959-BLOCKING-EVALUATION.conf",
    "./coreruleset-4.20.0/rules/RESPONSE-980-CORRELATION.conf",
    "./coreruleset-4.20.0/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example"
    };

    int ret;
    const char* error = NULL;

    modsec = modsecurity::msc_init();

    modsec->setConnectorInformation("ModSecurity-test v0.0.1-alpha" \
        " (ModSecurity test)");
    modsec->setServerLogCb(logCb, modsecurity::RuleMessageLogProperty
        | modsecurity::IncludeFullHighlightLogProperty);

    rules = modsecurity::msc_create_rules_set();

    // Load each rule file
    for (const char* rule_file : rule_files) {
        ret = modsecurity::msc_rules_add_file(rules, rule_file, &error);
        if (ret < 0) {
            fprintf(stderr, "Problems loading rule file: %s\n", rule_file);
            fprintf(stderr, "%s\n", error);
            system("pause");
        }
    }
    modsecurity::msc_rules_dump(rules);

    std::string log;
    std::string rawip;
    std::string cloudflareip;
    std::string request_body;
    std::map<std::string, std::string> headers;
    std::string path = "/";
    std::string method = "GET";

    modsecurity::Transaction* transaction = new modsecurity::Transaction(modsec, rules, NULL);
    process_intervention(transaction, log);

    if (cloudflareip.empty())
    {
        rawip = "127.0.0.1";
    }
    else
    {
        rawip = cloudflareip;
    }

    transaction->processConnection(rawip.c_str(), 12345, "127.0.0.1", 80);
    if (process_intervention(transaction, log))
    {
        if (transaction)
        {
            delete transaction;
            transaction = nullptr;
        }
        return 0;
    }

    transaction->processURI(path.c_str(), method.c_str(), "1.1");
    if (process_intervention(transaction, log))
    {
        if (transaction)
        {
            delete transaction;
            transaction = nullptr;
        }
        return 0;
    }

    for (auto header : headers)
    {
        transaction->addRequestHeader(header.first.c_str(),
            header.second.c_str());
    }

    if (process_intervention(transaction, log))
    {
        if (transaction)
        {
            delete transaction;
            transaction = nullptr;
        }
        return 0;
    }

    transaction->processRequestHeaders();
    if (process_intervention(transaction, log))
    {
        if (transaction)
        {
            delete transaction;
            transaction = nullptr;
        }
        return 0;
    }

    size_t body_len = request_body.size();

    transaction->appendRequestBody(
        (const unsigned char*)request_body.c_str(),
        body_len);

    if (process_intervention(transaction, log))
    {
        if (transaction)
        {
            delete transaction;
            transaction = nullptr;
        }
        return 0;
    }

    transaction->processRequestBody();
    if (process_intervention(transaction, log))
    {
        if (transaction)
        {
            delete transaction;
            transaction = nullptr;
        }
        return 0;
    }

    if (transaction)
    {
        delete transaction;
        transaction = nullptr;
    }

    return 0;
}

// Run program: Ctrl + F5 or Debug > Start Without Debugging menu
// Debug program: F5 or Debug > Start Debugging menu

// Tips for Getting Started: 
//   1. Use the Solution Explorer window to add/manage files
//   2. Use the Team Explorer window to connect to source control
//   3. Use the Output window to see build output and other messages
//   4. Use the Error List window to view errors
//   5. Go to Project > Add New Item to create new code files, or Project > Add Existing Item to add existing code files to the project
//   6. In the future, to open this project again, go to File > Open > Project and select the .sln file

My setting change in crs-setup.conf

# Default: Anomaly Scoring mode, log to error log, log to ModSecurity audit log
# - By default, offending requests are blocked with an error 403 response.
# - To change the disruptive action, see RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example
#   and review section 'Changing the Disruptive Action for Anomaly Mode'.
# - In Apache, you can use ErrorDocument to show a friendly error page or
#   perform a redirect: https://httpd.apache.org/docs/2.4/custom-error.html
#
SecDefaultAction "phase:1,log,auditlog,deny"
SecDefaultAction "phase:2,log,auditlog,deny"

[airween]

Thanks.

My first question: what did you mean here?

test.cpp: In function ‘int process_intervention(modsecurity::Transaction*, std::string&)’:
test.cpp:59:28: error: ‘_strdup’ was not declared in this scope; did you mean ‘strdup’?
   59 |         intervention.log = _strdup("(no log message was specified)");
      |                            ^~~~~~~
      |                            strdup

[ElevationsRPG]

Thanks.

My first question: what did you mean here?

test.cpp: In function ‘int process_intervention(modsecurity::Transaction*, std::string&)’:
test.cpp:59:28: error: ‘_strdup’ was not declared in this scope; did you mean ‘strdup’?
   59 |         intervention.log = _strdup("(no log message was specified)");
      |                            ^~~~~~~
      |                            strdup

Yes strdup is what I meant, in my c++23 msvc its deprecated so I use _strdup

[airween]

Thanks.

I just recompiled your example and it worked:

g++ test.cpp -lmodsecurity -lmimalloc

Then I tried to add your mentioned flag, but it seems mimalloc does not have MI_SECURE flag:

find /usr/include/ -name "mimalloc*" -type f -exec grep -i SECURE {} \;
[EMPTY]

so

export CFLAGS="-Wall -DMI_SECURE" CXXFLAGS="-Wall -DMI_SECURE" && g++ test.cpp -lmodsecurity -lmimalloc

modified nothing.

Do you have any idea how can I reproduce the issue on Linux?

[ElevationsRPG]

Thanks.

I just recompiled your example and it worked:

g++ test.cpp -lmodsecurity -lmimalloc

Then I tried to add your mentioned flag, but it seems mimalloc does not have MI_SECURE flag:

find /usr/include/ -name "mimalloc*" -type f -exec grep -i SECURE {} \;
[EMPTY]

so

export CFLAGS="-Wall -DMI_SECURE" CXXFLAGS="-Wall -DMI_SECURE" && g++ test.cpp -lmodsecurity -lmimalloc

modified nothing.

Do you have any idea how can I reproduce the issue on Linux?

Hi there so for Linux mimalloc needs to be installed with secure mode
Secure Mode

mimalloc can be build in secure mode by using the -DMI_SECURE=ON flags in cmake.

For instance, using vcpkg, you can install mimalloc with secure features by using the command vcpkg install mimalloc[secure].

Building mimalloc in secure mode on Linux:

To activate secure mode, build mimalloc using CMake and set the MI_SECURE flag to ON.

cmake -DMI_SECURE=ON .
make

Usage with secure mode:

Once built with MI_SECURE=ON, you can use the secure mimalloc library by preloading it when running your application:

Code

LD_PRELOAD=/path/to/libmimalloc-secure.so your_application

Also for Linux it is mentioned as a compiler define not flag e.g

Compiler defines : MI_SECURE=4;MI_DEBUG=3;MI_XMALLOC=1;MI_SHOW_ERRORS=1

As for my example the stack crash was reproducible from just running it even without MI_SECURE flag

[airween]

@ElevationsRPG

thanks, I was able to rebuild your example with mimalloc, but I wasn't able to reproduce the issue. Here is what I get:

$ MIMALLOC_SECURE=4 MIMALLOC_VERBOSE=1 ./my_app
mimalloc: process init: 0x763E344785C0
mimalloc: using 1 numa regions
mimalloc: v2.2.5, release (built on Nov 28 2025, 12:04:24)
mimalloc: option 'show_errors': 0 
mimalloc: option 'show_stats': 0 
mimalloc: option 'verbose': 1 
mimalloc: option 'eager_commit': 1 
mimalloc: option 'arena_eager_commit': 2 
mimalloc: option 'purge_decommits': 1 
mimalloc: option 'allow_large_os_pages': 2 
mimalloc: option 'reserve_huge_os_pages': 0 
mimalloc: option 'reserve_huge_os_pages_at': -1 
mimalloc: option 'reserve_os_memory': 0 KiB
mimalloc: option 'deprecated_segment_cache': 0 
mimalloc: option 'deprecated_page_reset': 0 
mimalloc: option 'abandoned_page_purge': 0 
mimalloc: option 'deprecated_segment_reset': 0 
mimalloc: option 'eager_commit_delay': 1 
mimalloc: option 'purge_delay': 10 
mimalloc: option 'use_numa_nodes': 0 
mimalloc: option 'disallow_os_alloc': 0 
mimalloc: option 'os_tag': 100 
mimalloc: option 'max_errors': 32 
mimalloc: option 'max_warnings': 32 
mimalloc: option 'max_segment_reclaim': 10 
mimalloc: option 'destroy_on_exit': 0 
mimalloc: option 'arena_reserve': 1048576 KiB
mimalloc: option 'arena_purge_mult': 10 
mimalloc: option 'purge_extend_delay': 1 
mimalloc: option 'abandoned_reclaim_on_free': 0 
mimalloc: option 'disallow_arena_alloc': 0 
mimalloc: option 'retry_on_oom': 400 
mimalloc: option 'visit_abandoned': 0 
mimalloc: option 'guarded_min': 0 
mimalloc: option 'guarded_max': 1073741824 
mimalloc: option 'guarded_precise': 0 
mimalloc: option 'guarded_sample_rate': 0 
mimalloc: option 'guarded_sample_seed': 0 
mimalloc: option 'target_segments_per_thread': 0 
mimalloc: option 'generic_collect': 10000 
mimalloc: debug level : 0
mimalloc: secure level: 1
mimalloc: mem tracking: none
mimalloc: reserved 1048576 KiB memory
Phase: 0 (30 rules)
    Rule ID: ./coreruleset-4.20.0/rules/REQUEST-901-INITIALIZATION.conf:454--0x5a40a381950
...
 * Match, but no disruptive action: ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "./coreruleset-4.20.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.21.0-dev"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "127.0.0.1"] [uri "/"] [unique_id "176433157010.184757"] [ref ""]
heap stats:     peak       total     current       block      total#   
  reserved:     1.0 GiB     1.0 GiB     1.0 GiB                          
 committed:     1.0 GiB     1.0 GiB     1.0 GiB                          
     reset:     0      
    purged:     0      
   touched:    64.2 KiB   128.5 KiB   -24.4 MiB                          
  segments:     2           2           2                                not all freed
-abandoned:     0           0           0                                ok
   -cached:     0           0           0                                ok
     pages:     0           0        -274                                not all freed
-abandoned:     0           0           0                                ok
 -extended:     0      
   -retire:     0      
    arenas:     1      
 -rollback:     0      
     mmaps:     3      
   commits:     0      
    resets:     0      
    purges:     0      
   guarded:     0      
   threads:     0           0           0                                ok
  searches:     0.0 avg
numa nodes:     1
   elapsed:     0.170 s
   process: user: 0.171 s, system: 0.010 s, faults: 0, rss: 50.3 MiB, commit: 1.0 GiB
mimalloc: process done: 0x763E344785C0

May I change something to reproduce the issue?

[ElevationsRPG]

@ElevationsRPG

thanks, I was able to rebuild your example with mimalloc, but I wasn't able to reproduce the issue. Here is what I get:

$ MIMALLOC_SECURE=4 MIMALLOC_VERBOSE=1 ./my_app
mimalloc: process init: 0x763E344785C0
mimalloc: using 1 numa regions
mimalloc: v2.2.5, release (built on Nov 28 2025, 12:04:24)
mimalloc: option 'show_errors': 0 
mimalloc: option 'show_stats': 0 
mimalloc: option 'verbose': 1 
mimalloc: option 'eager_commit': 1 
mimalloc: option 'arena_eager_commit': 2 
mimalloc: option 'purge_decommits': 1 
mimalloc: option 'allow_large_os_pages': 2 
mimalloc: option 'reserve_huge_os_pages': 0 
mimalloc: option 'reserve_huge_os_pages_at': -1 
mimalloc: option 'reserve_os_memory': 0 KiB
mimalloc: option 'deprecated_segment_cache': 0 
mimalloc: option 'deprecated_page_reset': 0 
mimalloc: option 'abandoned_page_purge': 0 
mimalloc: option 'deprecated_segment_reset': 0 
mimalloc: option 'eager_commit_delay': 1 
mimalloc: option 'purge_delay': 10 
mimalloc: option 'use_numa_nodes': 0 
mimalloc: option 'disallow_os_alloc': 0 
mimalloc: option 'os_tag': 100 
mimalloc: option 'max_errors': 32 
mimalloc: option 'max_warnings': 32 
mimalloc: option 'max_segment_reclaim': 10 
mimalloc: option 'destroy_on_exit': 0 
mimalloc: option 'arena_reserve': 1048576 KiB
mimalloc: option 'arena_purge_mult': 10 
mimalloc: option 'purge_extend_delay': 1 
mimalloc: option 'abandoned_reclaim_on_free': 0 
mimalloc: option 'disallow_arena_alloc': 0 
mimalloc: option 'retry_on_oom': 400 
mimalloc: option 'visit_abandoned': 0 
mimalloc: option 'guarded_min': 0 
mimalloc: option 'guarded_max': 1073741824 
mimalloc: option 'guarded_precise': 0 
mimalloc: option 'guarded_sample_rate': 0 
mimalloc: option 'guarded_sample_seed': 0 
mimalloc: option 'target_segments_per_thread': 0 
mimalloc: option 'generic_collect': 10000 
mimalloc: debug level : 0
mimalloc: secure level: 1
mimalloc: mem tracking: none
mimalloc: reserved 1048576 KiB memory
Phase: 0 (30 rules)
    Rule ID: ./coreruleset-4.20.0/rules/REQUEST-901-INITIALIZATION.conf:454--0x5a40a381950
...
 * Match, but no disruptive action: ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "./coreruleset-4.20.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.21.0-dev"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "127.0.0.1"] [uri "/"] [unique_id "176433157010.184757"] [ref ""]
heap stats:     peak       total     current       block      total#   
  reserved:     1.0 GiB     1.0 GiB     1.0 GiB                          
 committed:     1.0 GiB     1.0 GiB     1.0 GiB                          
     reset:     0      
    purged:     0      
   touched:    64.2 KiB   128.5 KiB   -24.4 MiB                          
  segments:     2           2           2                                not all freed
-abandoned:     0           0           0                                ok
   -cached:     0           0           0                                ok
     pages:     0           0        -274                                not all freed
-abandoned:     0           0           0                                ok
 -extended:     0      
   -retire:     0      
    arenas:     1      
 -rollback:     0      
     mmaps:     3      
   commits:     0      
    resets:     0      
    purges:     0      
   guarded:     0      
   threads:     0           0           0                                ok
  searches:     0.0 avg
numa nodes:     1
   elapsed:     0.170 s
   process: user: 0.171 s, system: 0.010 s, faults: 0, rss: 50.3 MiB, commit: 1.0 GiB
mimalloc: process done: 0x763E344785C0

May I change something to reproduce the issue?

Very strange the code produces stack trace for me, if you like i can make a crash dump? Otherwise only thing to try is run under debugger maybe..

[ElevationsRPG]

@ElevationsRPG

thanks, I was able to rebuild your example with mimalloc, but I wasn't able to reproduce the issue. Here is what I get:

$ MIMALLOC_SECURE=4 MIMALLOC_VERBOSE=1 ./my_app
mimalloc: process init: 0x763E344785C0
mimalloc: using 1 numa regions
mimalloc: v2.2.5, release (built on Nov 28 2025, 12:04:24)
mimalloc: option 'show_errors': 0 
mimalloc: option 'show_stats': 0 
mimalloc: option 'verbose': 1 
mimalloc: option 'eager_commit': 1 
mimalloc: option 'arena_eager_commit': 2 
mimalloc: option 'purge_decommits': 1 
mimalloc: option 'allow_large_os_pages': 2 
mimalloc: option 'reserve_huge_os_pages': 0 
mimalloc: option 'reserve_huge_os_pages_at': -1 
mimalloc: option 'reserve_os_memory': 0 KiB
mimalloc: option 'deprecated_segment_cache': 0 
mimalloc: option 'deprecated_page_reset': 0 
mimalloc: option 'abandoned_page_purge': 0 
mimalloc: option 'deprecated_segment_reset': 0 
mimalloc: option 'eager_commit_delay': 1 
mimalloc: option 'purge_delay': 10 
mimalloc: option 'use_numa_nodes': 0 
mimalloc: option 'disallow_os_alloc': 0 
mimalloc: option 'os_tag': 100 
mimalloc: option 'max_errors': 32 
mimalloc: option 'max_warnings': 32 
mimalloc: option 'max_segment_reclaim': 10 
mimalloc: option 'destroy_on_exit': 0 
mimalloc: option 'arena_reserve': 1048576 KiB
mimalloc: option 'arena_purge_mult': 10 
mimalloc: option 'purge_extend_delay': 1 
mimalloc: option 'abandoned_reclaim_on_free': 0 
mimalloc: option 'disallow_arena_alloc': 0 
mimalloc: option 'retry_on_oom': 400 
mimalloc: option 'visit_abandoned': 0 
mimalloc: option 'guarded_min': 0 
mimalloc: option 'guarded_max': 1073741824 
mimalloc: option 'guarded_precise': 0 
mimalloc: option 'guarded_sample_rate': 0 
mimalloc: option 'guarded_sample_seed': 0 
mimalloc: option 'target_segments_per_thread': 0 
mimalloc: option 'generic_collect': 10000 
mimalloc: debug level : 0
mimalloc: secure level: 1
mimalloc: mem tracking: none
mimalloc: reserved 1048576 KiB memory
Phase: 0 (30 rules)
    Rule ID: ./coreruleset-4.20.0/rules/REQUEST-901-INITIALIZATION.conf:454--0x5a40a381950
...
 * Match, but no disruptive action: ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "./coreruleset-4.20.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.21.0-dev"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "127.0.0.1"] [uri "/"] [unique_id "176433157010.184757"] [ref ""]
heap stats:     peak       total     current       block      total#   
  reserved:     1.0 GiB     1.0 GiB     1.0 GiB                          
 committed:     1.0 GiB     1.0 GiB     1.0 GiB                          
     reset:     0      
    purged:     0      
   touched:    64.2 KiB   128.5 KiB   -24.4 MiB                          
  segments:     2           2           2                                not all freed
-abandoned:     0           0           0                                ok
   -cached:     0           0           0                                ok
     pages:     0           0        -274                                not all freed
-abandoned:     0           0           0                                ok
 -extended:     0      
   -retire:     0      
    arenas:     1      
 -rollback:     0      
     mmaps:     3      
   commits:     0      
    resets:     0      
    purges:     0      
   guarded:     0      
   threads:     0           0           0                                ok
  searches:     0.0 avg
numa nodes:     1
   elapsed:     0.170 s
   process: user: 0.171 s, system: 0.010 s, faults: 0, rss: 50.3 MiB, commit: 1.0 GiB
mimalloc: process done: 0x763E344785C0

May I change something to reproduce the issue?

Very strange the code produces stack trace for me, if you like i can make a crash dump? Otherwise only thing to try is run under debugger maybe..