lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-30 22:43:12 +03:00
Code Activity

malloc: tcache: Validate tc_idx before checking for double-frees [BZ #23907]

Browse Source 
The previous check could read beyond the end of the tcache entry
array.  If the e->key == tcache cookie check happened to pass, this
would result in crashes.
This commit is contained in:
Florian Weimer
2018-11-26 20:06:37 +01:00
parent 8ae74eadb6
commit affec03b71
2 changed files with 31 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ChangeLog
View File

@ -1,3 +1,9 @@
2018-11-26 Florian Weimer <fweimer@redhat.com>
[BZ #23907]
* malloc/malloc.c (_int_free): Validate tc_idx before checking for
double-frees.
2018-11-26 Rafael Ávila de Espíndola <rafael@espindo.la> 2018-11-26 Rafael Ávila de Espíndola <rafael@espindo.la>
[BZ #19767] [BZ #19767]

18
malloc/malloc.c
View File

@ -4225,15 +4225,16 @@ _int_free (mstate av, mchunkptr p, int have_lock)
#if USE_TCACHE #if USE_TCACHE
{ {
size_t tc_idx = csize2tidx (size); size_t tc_idx = csize2tidx (size);
if (tcache != NULL && tc_idx < mp_.tcache_bins)
{
/* Check to see if it's already in the tcache. */ /* Check to see if it's already in the tcache. */
tcache_entry *e = (tcache_entry *) chunk2mem (p); tcache_entry *e = (tcache_entry *) chunk2mem (p);
/* This test succeeds on double free. However, we don't 100% /* This test succeeds on double free. However, we don't 100%
trust it (it also matches random payload data at a 1 in trust it (it also matches random payload data at a 1 in
2^<size_t> chance), so verify it's not an unlikely coincidence 2^<size_t> chance), so verify it's not an unlikely
before aborting. */ coincidence before aborting. */
if (__glibc_unlikely (e->key == tcache && tcache)) if (__glibc_unlikely (e->key == tcache))
{ {
tcache_entry *tmp; tcache_entry *tmp;
LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx); LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
@ -4242,18 +4243,17 @@ _int_free (mstate av, mchunkptr p, int have_lock)
tmp = tmp->next) tmp = tmp->next)
if (tmp == e) if (tmp == e)
malloc_printerr ("free(): double free detected in tcache 2"); malloc_printerr ("free(): double free detected in tcache 2");
/* If we get here, it was a coincidence. We've wasted a few /* If we get here, it was a coincidence. We've wasted a
cycles, but don't abort. */ few cycles, but don't abort. */
} }
if (tcache if (tcache->counts[tc_idx] < mp_.tcache_count)
&& tc_idx < mp_.tcache_bins
&& tcache->counts[tc_idx] < mp_.tcache_count)
{ {
tcache_put (p, tc_idx); tcache_put (p, tc_idx);
return; return;
} }
} }
}
#endif #endif
/* /*