$ show GrapheneOS/hardened_malloc
hardened_malloc is a security-focused replacement for the C heap allocator, compiled as a shared library and used either via LD_PRELOAD or integrated directly into a libc such as Bionic on GrapheneOS. It implements the full malloc family (malloc/calloc/realloc/free, posix_memalign/aligned_alloc, malloc_usable_size) plus hardened extensions such as malloc_object_size, free_sized, and free_aligned_sized, along with C++ operator new/delete wrappers. Its architecture is a single monolithic C library: all mutable allocator state lives in one read-only-after-init metadata region; slab allocations are partitioned into per-size-class regions inside statically reserved address space, and large allocations are mmap-backed with randomized guard pages and a quarantine. It targets 64-bit Linux and currently builds against Bionic, glibc, and musl.
The LLM identified 3 files worth highlighting for reuse:
Implements a small, self-contained ChaCha8-based CSPRNG with cached keystream output, automatic reseeding from getrandom, and Lemire's unbiased integer range generation for u16/u32/u64. It is isolated (only depends on chacha.c and util.h) and can be lifted into other C projects needing fast, cryptographically secure random numbers without pulling in a full allocator.
Provides page allocation with optional guard regions, aligned allocation with guard pages, and deallocation that unmaps the full guard-plus-usable range or falls back to madvise purge. It encapsulates overflow-checked size arithmetic and split-mapping cleanup without leaking mappings, making it reusable for any low-level memory-management subsystem that needs protected guard regions around allocations.
A standalone inline header that tags and zeroes a memory region using ARM MTE instructions (STZG/DC GZVA), optimized to operate cache-line-at-a-time and fall back to per-granule stores. It is directly reusable in any MTE-enabled allocator or memory-safety tool and includes detailed comments explaining the instruction choices and alignment requirements.