[Bug malloc/25945] memory block return by tcache_get() may contain anather valid memory block pointer, leading to information disclosure

["wangxuszcn at foxmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=25945

--- Comment #2 from wangxu <wangxuszcn at foxmail dot com> ---
(In reply to wangxu from comment #0)
> The malloc function in the GNU C Library (aka glibc or libc6) since 2.26,
> may return a memory block which contain another valid memory block pointer,
> potentially leading to memory leak. This occurs because the  function
> tcache_get() of per-thread cache (aka tcache) feature does not set e->next =
> NULL. 
> 
> patche canbe:
> 
> @@ -2936,6 +3074,7 @@ tcache_get (size_t tc_idx)
>    tcache->entries[tc_idx] = e->next;
>    --(tcache->counts[tc_idx]);
>    e->key = NULL;
> +  e->next = NULL;
>    return (void *) e;
>  }
> 
> BTW,can we request a CVE?

"memory leak" should be "information disclosure", disclosing another valid
memory block pointer.

-- 
You are receiving this mail because:
You are on the CC list for the bug.