You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
25 lines
1.1 KiB
25 lines
1.1 KiB
From 17f487b7afa7cd6c316040f3e6c86dc96b2eec30 Mon Sep 17 00:00:00 2001 |
|
From: DJ Delorie <dj@delorie.com> |
|
Date: Fri, 17 Mar 2017 15:31:38 -0400 |
|
Subject: [PATCH] Further harden glibc malloc metadata against 1-byte |
|
overflows. |
|
|
|
Additional check for chunk_size == next->prev->chunk_size in unlink() |
|
|
|
2017-03-17 Chris Evans <scarybeasts@gmail.com> |
|
|
|
* malloc/malloc.c (unlink): Add consistency check between size and |
|
next->prev->size, to further harden against 1-byte overflows. |
|
|
|
diff -rup a/malloc/malloc.c b/malloc/malloc.c |
|
--- a/malloc/malloc.c 2017-08-01 18:11:00.000000000 -0400 |
|
+++ b/malloc/malloc.c 2017-08-01 18:13:07.907438098 -0400 |
|
@@ -1429,6 +1429,8 @@ typedef struct malloc_chunk* mbinptr; |
|
|
|
/* Take a chunk off a bin list */ |
|
#define unlink(AV, P, BK, FD) { \ |
|
+ if (__builtin_expect (chunksize(P) != next_chunk(P)->prev_size, 0)) \ |
|
+ malloc_printerr (check_action, "corrupted size vs. prev_size", P, AV); \ |
|
FD = P->fd; \ |
|
BK = P->bk; \ |
|
if (__builtin_expect (FD->bk != P || BK->fd != P, 0)) { \
|
|
|