[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 9 Sep 2023 01:49:39 +0800
From: James Raphael Tiovalen <jamestiotio@...il.com>
To: musl@...ts.openwall.com
Cc: James Raphael Tiovalen <jamestiotio@...il.com>
Subject: [PATCH] Add a safe dequeue integrity check for mallocng
This commit adds an integrity check to allow for safer dequeuing of meta
structs in mallocng. If the unlikely condition is true due to some sort
of heap corruption, we print an error message and abort.
This approach is similar to the safe unlinking check performed by glibc.
While this check would not prevent more sophisticated attacks in more
specific scenarios, as shown by the historical exploitation efforts on
glibc, this check would prevent more basic heap corruption attacks from
being successfully executed.
---
src/malloc/mallocng/meta.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/malloc/mallocng/meta.h b/src/malloc/mallocng/meta.h
index 61ec53f9..57946d01 100644
--- a/src/malloc/mallocng/meta.h
+++ b/src/malloc/mallocng/meta.h
@@ -2,9 +2,11 @@
#define MALLOC_META_H
#include <stdint.h>
+#include <stdio.h>
#include <errno.h>
#include <limits.h>
#include "glue.h"
+#include "libm.h"
__attribute__((__visibility__("hidden")))
extern const uint16_t size_classes[];
@@ -90,6 +92,10 @@ static inline void queue(struct meta **phead, struct meta *m)
static inline void dequeue(struct meta **phead, struct meta *m)
{
if (m->next != m) {
+ if (predict_false(m->prev->next != m || m->next->prev != m)) {
+ fprintf(stderr, "Corrupted doubly-linked meta list\n");
+ abort();
+ }
m->prev->next = m->next;
m->next->prev = m->prev;
if (*phead == m) *phead = m->next;
--
2.42.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
