[Bug malloc/27052] New: double free detection mechanism of tcache can invoke endless-loop in _int_free

["ssmallkirby at gmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=27052

            Bug ID: 27052
           Summary: double free detection mechanism of tcache can invoke
                    endless-loop in _int_free
           Product: glibc
           Version: 2.32
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: ssmallkirby at gmail dot com
  Target Milestone: ---

Since glibc 2.29, tcache has a 'key' member, which detects double free of
tcache chunk.
If linked-list of tcache contains a loop, it invokes infinite loop in
_int_free. I think this loop should terminate and the program should abort if
tcache has more than 7 chunks.
Below code invokes such infinite loop in _int_free and the program never
terminates. It might be possible for this problem to be abused for DoS attack.

// tested on glibc 2.32
#include<stdio.h>
#include<stdlib.h>

unsigned long protect_ptr(unsigned long pos, unsigned long ptr){
  return (pos>>12) ^ (ptr);
}

int main(void)
{
  char *a,*b,*c;
  a = malloc(0x50);
  b = malloc(0x50);
  c = malloc(0x50);
  free(a);
  free(b);

  *(unsigned long*)(b) = (unsigned long*)protect_ptr(b, b);
  ((unsigned long*)c)[1] = ((unsigned long*)a)[1];
  free(c);

  return 0;
}

-- 
You are receiving this mail because:
You are on the CC list for the bug.