This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Additional malloc hardening
- From: Florian Weimer <fweimer at redhat dot com>
- To: GNU C Library <libc-alpha at sourceware dot org>
- Date: Mon, 18 Aug 2014 15:53:29 +0200
- Subject: Additional malloc hardening
- Authentication-results: sourceware.org; auth=none
I would like to add a few more heap consistency checks to the malloc
implementation.
My initial focus is on allocation from the unsorted_chunks list. There
seem to be a few invariants which are cheap to check for each chunk:
- The PREV_INUSE bit is set.
- The PREV_INUSE bit of the chunk after the foot is unset.
- The size in the foot is equal to the size in the head.
- The size of a chunk not in the main arena is less than HEAP_MAX_SIZE.
The first two might not actually be true at the borders. Is it possible
to cheaply identify these conditions?
--
Florian Weimer / Red Hat Product Security