[Bug malloc/23907] Incorrect double-free malloc tcache check disregards tcache size

["cvs-commit at gcc dot gnu.org" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=23907

--- Comment #4 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.28/master has been updated
       via  b8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa (commit)
      from  ce6ba630dbc96f49eb1f30366aa62261df4792f9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa

commit b8dd0f42780a3133c02f064a2c0c5c4e7ab61aaa
Author: DJ Delorie <dj@delorie.com>
Date:   Tue Nov 20 13:24:09 2018 -0500

    malloc: tcache double free check

    * malloc/malloc.c (tcache_entry): Add key field.
    (tcache_put): Set it.
    (tcache_get): Likewise.
    (_int_free): Check for double free in tcache.
    * malloc/tst-tcfree1.c: New.
    * malloc/tst-tcfree2.c: New.
    * malloc/Makefile: Run the new tests.
    * manual/probes.texi: Document memory_tcache_double_free probe.

    * dlfcn/dlerror.c (check_free): Prevent double frees.

    (cherry picked from commit bcdaad21d4635931d1bd3b54a7894276925d081d)

    malloc: tcache: Validate tc_idx before checking for double-frees [BZ
#23907]

    The previous check could read beyond the end of the tcache entry
    array.  If the e->key == tcache cookie check happened to pass, this
    would result in crashes.

    (cherry picked from commit affec03b713c82c43a5b025dddc21bde3334f41e)

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                                          |   20 +++++++++
 dlfcn/dlerror.c                                    |    5 ++-
 malloc/Makefile                                    |    1 +
 malloc/malloc.c                                    |   40 ++++++++++++++++---
 .../x86/tst-cet-legacy-1.c => malloc/tst-tcfree1.c |   36 ++++++++---------
 .../x86/tst-cet-legacy-1.c => malloc/tst-tcfree2.c |   42 +++++++++++---------
 manual/probes.texi                                 |   12 ++++++
 7 files changed, 111 insertions(+), 45 deletions(-)
 copy sysdeps/x86/tst-cet-legacy-1.c => malloc/tst-tcfree1.c (67%)
 copy sysdeps/x86/tst-cet-legacy-1.c => malloc/tst-tcfree2.c (60%)

-- 
You are receiving this mail because:
You are on the CC list for the bug.