[Bug malloc/26306] New: Confusion in malloc.c about the fastbins size check.

["hkrawbytes at gmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=26306

            Bug ID: 26306
           Summary: Confusion in malloc.c  about the fastbins size check.
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: hkrawbytes at gmail dot com
  Target Milestone: ---

Created attachment 12728
  --> https://sourceware.org/bugzilla/attachment.cgi?id=12728&action=edit
poc

It looks like there's some confusion in malloc.c as to whether the fastbin
index should be treated as an int or a long int during the fastbin size
integrity check. The fastbin_idx macro casts the chunk size field down to an
unsigned int, which is then confusingly stored as a long int for use in the
integrity check.
And it presents in the latest glibc versions and also in old one's.
The result is that, the fastbin size integrity check only applies to the 4
least-significant bytes of the size field.

Here's the POC.

```
#include<stdio.h>
#include<stdlib.h>
#include<string.h>

int main()
{
        char *i[7];
        char *j;
        int s;
        char *k[7];     
        char *b;
        for(s = 0;s<7;s++) {
                i[s] = (char *) malloc(0x10);
        }
        j = (char *) malloc(0x10);
        for(s=0;s<7;s++) {
                free(i[s]);
        }
        free(j);
        memcpy((j - 0x8),"\x21\x00\x00\x00\x61\x61\x61\x61", 8);                
        for(s=0;s<7;s++) {
                k[s] = (char *) malloc(0x10);
        }
        b = (char *) malloc(0x10);


}
```
The fastbin size integrity check should check for the whole qword right?.

-- 
You are receiving this mail because:
You are on the CC list for the bug.