Bug 457 - Incorrect checks in MALLOC_CHECK_ functions under high mem usage
Summary: Incorrect checks in MALLOC_CHECK_ functions under high mem usage
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.3.3
: P2 normal
Target Milestone: ---
Assignee: wg@malloc.de
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-10-18 00:32 UTC by Michael Dalton
Modified: 2019-04-10 12:06 UTC (History)
2 users (show)

See Also:
Host: i686-pc-linux-gnu
Target: i686-pc-linux-gnu
Build: i686-pc-linux-gnu
Last reconfirmed:
fweimer: security?


Attachments
Proposed fix for current CVS (878 bytes, patch)
2004-10-19 17:04 UTC, Wolfram Gloger
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Michael Dalton 2004-10-18 00:32:42 UTC
In malloc/hooks.c, the code in mem2chunk_check(lines 178-179,183) and
check_top_chunk(line 234) assumes that 
anything allocated in main_arena will always be between main_arena.sbrk_base
and main_arena.sbrk_base + main_arena.system_mem. This is not true, as 
when brk fails, mmap can be used for main_arena, which happens in lines
2906-2935 of malloc.c. Chunks allocated(including the top) from this
mmap'd portion of main_arena will not fall under the sbrk_base-sbrk_base 
+ system_mem bounds, cause spurious "top chunk corurpt" 
and invalid pointer messages from mem2chunk_check and check_top_check. The
corect fix is to check if main arena
is contiguous before applying those checks(this is done in the MALLOC_DEBUG
function do_check_malloc_state, malloc.c line 2576). The noncontiguous bit 
set as soon as we begin using mmap as a brk replacement, so any and all
checks relating to sbrk_base in the MALLOC_CHECK_ functions should be
changed to check for said condition || noncontiguous(&main_arena). Hope this 
helped, please e-mail me if I need to clarify any points I've made, as
I must admit that this is my first bug report =)
Comment 1 wg@malloc.de 2004-10-19 15:50:23 UTC
Subject: Re:  Incorrect checks in MALLOC_CHECK_  functions under high mem usage

Working on fix at this moment..

Regards,
Wolfram.

Comment 2 Wolfram Gloger 2004-10-19 17:04:26 UTC
Created attachment 230 [details]
Proposed fix for current CVS

Please test.
Comment 3 Michael Dalton 2004-10-20 11:44:14 UTC
The proposed patch works fine. I'll send a few random testcases I have that
might prove of interest in one sec. Sorry for the slow response, had some a
little trouble building glibc from cvs. Thanks 

Mike