[glibc/release/2.29/master] malloc: Check for large bin list corruption when inserting unsorted chunk

[Arjun Shankar <arjun at sourceware dot org>]

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=52b7cd6e9a701bb203023d56e84551943dc6a4c0

commit 52b7cd6e9a701bb203023d56e84551943dc6a4c0
Author: Adam Maris <amaris@redhat.com>
Date:   Thu Mar 14 16:51:16 2019 -0400

    malloc: Check for large bin list corruption when inserting unsorted chunk
    
    Fixes bug 24216. This patch adds security checks for bk and bk_nextsize pointers
    of chunks in large bin when inserting chunk from unsorted bin. It was possible
    to write the pointer to victim (newly inserted chunk) to arbitrary memory
    locations if bk or bk_nextsize pointers of the next large bin chunk
    got corrupted.
    
    (cherry picked from commit 5b06f538c5aee0389ed034f60d90a8884d6d54de)

Diff:
---
 malloc/malloc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/malloc/malloc.c b/malloc/malloc.c
index feaf7ee..ce77137 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3876,10 +3876,14 @@ _int_malloc (mstate av, size_t bytes)
                         {
                           victim->fd_nextsize = fwd;
                           victim->bk_nextsize = fwd->bk_nextsize;
+                          if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd))
+                            malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)");
                           fwd->bk_nextsize = victim;
                           victim->bk_nextsize->fd_nextsize = victim;
                         }
                       bck = fwd->bk;
+                      if (bck->fd != fwd)
+                        malloc_printerr ("malloc(): largebin double linked list corrupted (bk)");
                     }
                 }
               else