diff options
| author | Pochang Chen <johnchen902@gmail.com> | 2018-08-16 15:24:24 -0400 |
|---|---|---|
| committer | DJ Delorie <dj@delorie.com> | 2018-08-16 15:24:24 -0400 |
| commit | 30a17d8c95fbfb15c52d1115803b63aaa73a285c (patch) | |
| tree | 9cc656df2264773490117fda7628fd9abf4dd943 | |
| parent | 34f86d61687457aa57d40cf3c230ca8404d40e45 (diff) | |
| download | glibc-30a17d8c95fbfb15c52d1115803b63aaa73a285c.tar.gz glibc-30a17d8c95fbfb15c52d1115803b63aaa73a285c.tar.xz glibc-30a17d8c95fbfb15c52d1115803b63aaa73a285c.zip | |
malloc: Verify size of top chunk.
The House of Force is a well-known technique to exploit heap overflow. In essence, this exploit takes three steps: 1. Overwrite the size of top chunk with very large value (e.g. -1). 2. Request x bytes from top chunk. As the size of top chunk is corrupted, x can be arbitrarily large and top chunk will still be offset by x. 3. The next allocation from top chunk will thus be controllable. If we verify the size of top chunk at step 2, we can stop such attack.
| -rw-r--r-- | ChangeLog | 4 | ||||
| -rw-r--r-- | malloc/malloc.c | 3 |
2 files changed, 7 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog index cd60ef8399..dc72e54f00 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +2018-08-16 Pochang Chen <johnchen902@gmail.com> + + * malloc/malloc.c (_int_malloc.c): Verify size of top chunk. + 2018-08-16 Siddhesh Poyarekar <siddhesh@sourceware.org> * benchtests/bench-strlen.c (do_test): Allocate buffers before diff --git a/malloc/malloc.c b/malloc/malloc.c index e247c77b7d..9431108626 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -4076,6 +4076,9 @@ _int_malloc (mstate av, size_t bytes) victim = av->top; size = chunksize (victim); + if (__glibc_unlikely (size > av->system_mem)) + malloc_printerr ("malloc(): corrupted top size"); + if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE)) { remainder_size = size - nb; |