public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug malloc/27052] New: double free detection mechanism of tcache can invoke endless-loop in _int_free
@ 2020-12-11 13:09 ssmallkirby at gmail dot com
0 siblings, 0 replies; only message in thread
From: ssmallkirby at gmail dot com @ 2020-12-11 13:09 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=27052
Bug ID: 27052
Summary: double free detection mechanism of tcache can invoke
endless-loop in _int_free
Product: glibc
Version: 2.32
Status: UNCONFIRMED
Severity: minor
Priority: P2
Component: malloc
Assignee: unassigned at sourceware dot org
Reporter: ssmallkirby at gmail dot com
Target Milestone: ---
Since glibc 2.29, tcache has a 'key' member, which detects double free of
tcache chunk.
If linked-list of tcache contains a loop, it invokes infinite loop in
_int_free. I think this loop should terminate and the program should abort if
tcache has more than 7 chunks.
Below code invokes such infinite loop in _int_free and the program never
terminates. It might be possible for this problem to be abused for DoS attack.
// tested on glibc 2.32
#include<stdio.h>
#include<stdlib.h>
unsigned long protect_ptr(unsigned long pos, unsigned long ptr){
return (pos>>12) ^ (ptr);
}
int main(void)
{
char *a,*b,*c;
a = malloc(0x50);
b = malloc(0x50);
c = malloc(0x50);
free(a);
free(b);
*(unsigned long*)(b) = (unsigned long*)protect_ptr(b, b);
((unsigned long*)c)[1] = ((unsigned long*)a)[1];
free(c);
return 0;
}
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-12-11 13:09 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-12-11 13:09 [Bug malloc/27052] New: double free detection mechanism of tcache can invoke endless-loop in _int_free ssmallkirby at gmail dot com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).