[Bug malloc/25945] New: memory block return by tcache_get() may contain anather valid memory block pointer, leading to memory leak

["wangxuszcn at foxmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=25945

            Bug ID: 25945
           Summary: memory block return by tcache_get()  may contain
                    anather valid memory block pointer, leading to memory
                    leak
           Product: glibc
           Version: 2.26
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: wangxuszcn at foxmail dot com
  Target Milestone: ---

The malloc function in the GNU C Library (aka glibc or libc6) since 2.26, may
return a memory block which contain another valid memory block pointer,
potentially leading to memory leak. This occurs because the  function
tcache_get() of per-thread cache (aka tcache) feature does not set e->next =
NULL. 

patche canbe:

@@ -2936,6 +3074,7 @@ tcache_get (size_t tc_idx)
   tcache->entries[tc_idx] = e->next;
   --(tcache->counts[tc_idx]);
   e->key = NULL;
+  e->next = NULL;
   return (void *) e;
 }

BTW,can we request a CVE?

-- 
You are receiving this mail because:
You are on the CC list for the bug.