public inbox for glibc-cvs@sourceware.org
help / color / mirror / Atom feed
* [glibc/ibm/2.28/master] malloc: Check for large bin list corruption when inserting unsorted chunk
@ 2019-06-27 14:31 Tulio Magno Quites Machado Filho
0 siblings, 0 replies; only message in thread
From: Tulio Magno Quites Machado Filho @ 2019-06-27 14:31 UTC (permalink / raw)
To: glibc-cvs
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4a5e58827f2b6efa94ea50a9db5f3c861173837f
commit 4a5e58827f2b6efa94ea50a9db5f3c861173837f
Author: Adam Maris <amaris@redhat.com>
Date: Thu Mar 14 16:51:16 2019 -0400
malloc: Check for large bin list corruption when inserting unsorted chunk
Fixes bug 24216. This patch adds security checks for bk and bk_nextsize pointers
of chunks in large bin when inserting chunk from unsorted bin. It was possible
to write the pointer to victim (newly inserted chunk) to arbitrary memory
locations if bk or bk_nextsize pointers of the next large bin chunk
got corrupted.
(cherry picked from commit 5b06f538c5aee0389ed034f60d90a8884d6d54de)
Diff:
---
malloc/malloc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 6ae22e6..0e9a2e2 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3869,10 +3869,14 @@ _int_malloc (mstate av, size_t bytes)
{
victim->fd_nextsize = fwd;
victim->bk_nextsize = fwd->bk_nextsize;
+ if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd))
+ malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)");
fwd->bk_nextsize = victim;
victim->bk_nextsize->fd_nextsize = victim;
}
bck = fwd->bk;
+ if (bck->fd != fwd)
+ malloc_printerr ("malloc(): largebin double linked list corrupted (bk)");
}
}
else
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2019-06-27 14:31 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-27 14:31 [glibc/ibm/2.28/master] malloc: Check for large bin list corruption when inserting unsorted chunk Tulio Magno Quites Machado Filho
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).