Re: [suggestion] tcache double-free check

[Florian Weimer <fweimer@redhat.com>]

* Carlos O'Donell:

>> Instead of using some arbitrary constant or coming up with a fancy
>> random value, is it possible we update the key to something that won't
>> point to a critical memory management struct such as the tcache
>> control block? I suggest a simple change that will ensure that the
>> value used won't be a pointer that can be dereferenced: ~tcache
>> (instead of tcache). The bitwise not costs a mere 1 CPU cycle, while
>> making sure the key won't be a valid memory address.
>
> That sounds good to me.
>
> I assume the point being that you can't use a "memory derefernce"
> gadget directly with that memory, you'd need some other primitive
> to process the ~tcache.

Why can't we use a random marker value?  Then we don't leak an address,
either.

Thanks,
Florian