lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-28 00:21:52 +03:00
Code Activity

Further harden glibc malloc metadata against 1-byte overflows.

Browse Source 
Additional check for chunk_size == next->prev->chunk_size in unlink()

2017-03-17  Chris Evans  <scarybeasts@gmail.com>

	* malloc/malloc.c (unlink): Add consistency check between size and
	next->prev->size, to further harden against 1-byte overflows.
This commit is contained in:
DJ Delorie
2017-03-17 15:31:38 -04:00
parent b170d2e7ab
commit 17f487b7af
2 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -1,3 +1,8 @@
2017-03-17 Chris Evans <scarybeasts@gmail.com>
* malloc/malloc.c (unlink): Add consistency check between size and
next->prev->size, to further harden against 1-byte overflows.
2017-03-17 H.J. Lu <hongjiu.lu@intel.com> 2017-03-17 H.J. Lu <hongjiu.lu@intel.com>
* sysdeps/x86/cpu-features.c (init_cpu_features): Check AVX with * sysdeps/x86/cpu-features.c (init_cpu_features): Check AVX with

2
malloc/malloc.c
View File

@ -1376,6 +1376,8 @@ typedef struct malloc_chunk *mbinptr;
/* Take a chunk off a bin list */ /* Take a chunk off a bin list */
#define unlink(AV, P, BK, FD) { \ #define unlink(AV, P, BK, FD) { \
if (__builtin_expect (chunksize(P) != prev_size (next_chunk(P)), 0)) \
malloc_printerr (check_action, "corrupted size vs. prev_size", P, AV); \
FD = P->fd; \ FD = P->fd; \
BK = P->bk; \ BK = P->bk; \
if (__builtin_expect (FD->bk != P || BK->fd != P, 0)) \ if (__builtin_expect (FD->bk != P || BK->fd != P, 0)) \