This is the mail archive of the mailing list for the glibc project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[PATCH] malloc: verify the size of top chuck, stopping House of Force

The House of Force is a well-known technique to exploit heap
overflow. In essence, this exploit takes three steps:
1. Overwrite the size of top chunk with very large value (e.g. -1).
2. Request x bytes from top chunk. As the size of top chunk
   is corrupted, x can be arbitrarily large and top chunk will
   still be offset by x.
3. The next allocation from top chunk will thus be controllable.

If we verify the size of top chunk at step 2, we can stop such attack.

2017-10-26  Pochang Chen  <>
    * malloc/malloc.c (_int_malloc.c): verify size of top chunk
 malloc/malloc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/malloc/malloc.c b/malloc/malloc.c
index f94d51cca1..d93eca6273 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4076,6 +4076,11 @@ _int_malloc (mstate av, size_t bytes)
       victim = av->top;
       size = chunksize (victim);

+      if (__glibc_unlikely (size > av->system_mem))
+        {
+          malloc_printerr ("malloc(): corrupted top size");
+        }
       if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
           remainder_size = size - nb;

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]