Ben Kallus
d10176c0ff
malloc: Add size check when moving fastbin->tcache ...
By overwriting a forward link in a fastbin chunk that is subsequently
moved into the tcache, it's possible to get malloc to return an
arbitrary address [0].
When a chunk is fetched from a fastbin, its size is checked against the
expected chunk size for that fastbin (see malloc.c:3991). This patch
adds a similar check for chunks being moved from a fastbin to tcache,
which renders obsolete the exploitation technique described above.
Now updated to use __glibc_unlikely instead of __builtin_expect, as
requested.
[0]: https://github.com/shellphish/how2heap/blob/master/glibc_2.39/fastbin_reverse_into_tcache.c
Signed-off-by: Ben Kallus <benjamin.p.kallus.gr@dartmouth.edu>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
2025-02-13 16:31:28 -03:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2021-02-23 10:04:45 +01:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-02-13 16:31:28 -03:00
2025-01-01 11:22:09 -08:00
2014-01-02 09:40:10 +01:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-02-02 20:10:09 +01:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2023-05-08 16:40:10 -04:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-25 05:34:05 +00:00
2025-01-01 11:22:09 -08:00
2021-07-22 18:37:59 +05:30
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2021-04-07 02:35:50 +02:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2016-12-31 23:49:24 +05:30
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2019-06-10 22:12:08 +00:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2022-01-26 10:38:23 -07:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2025-01-01 11:22:09 -08:00
2007-12-16 22:57:57 +00:00
2025-01-01 11:22:09 -08:00
2022-10-28 18:43:58 +01:00
d10176c0ff