This is the mail archive of the
glibc-cvs@sourceware.org
mailing list for the glibc project.
GNU C Library master sources branch master updated. glibc-2.28.9000-65-g30a17d8
- From: dj at sourceware dot org
- To: glibc-cvs at sourceware dot org
- Date: 16 Aug 2018 19:29:40 -0000
- Subject: GNU C Library master sources branch master updated. glibc-2.28.9000-65-g30a17d8
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".
The branch, master has been updated
via 30a17d8c95fbfb15c52d1115803b63aaa73a285c (commit)
from 34f86d61687457aa57d40cf3c230ca8404d40e45 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
http://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=30a17d8c95fbfb15c52d1115803b63aaa73a285c
commit 30a17d8c95fbfb15c52d1115803b63aaa73a285c
Author: Pochang Chen <johnchen902@gmail.com>
Date: Thu Aug 16 15:24:24 2018 -0400
malloc: Verify size of top chunk.
The House of Force is a well-known technique to exploit heap
overflow. In essence, this exploit takes three steps:
1. Overwrite the size of top chunk with very large value (e.g. -1).
2. Request x bytes from top chunk. As the size of top chunk
is corrupted, x can be arbitrarily large and top chunk will
still be offset by x.
3. The next allocation from top chunk will thus be controllable.
If we verify the size of top chunk at step 2, we can stop such attack.
diff --git a/ChangeLog b/ChangeLog
index cd60ef8..dc72e54 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2018-08-16 Pochang Chen <johnchen902@gmail.com>
+
+ * malloc/malloc.c (_int_malloc.c): Verify size of top chunk.
+
2018-08-16 Siddhesh Poyarekar <siddhesh@sourceware.org>
* benchtests/bench-strlen.c (do_test): Allocate buffers before
diff --git a/malloc/malloc.c b/malloc/malloc.c
index e247c77..9431108 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4076,6 +4076,9 @@ _int_malloc (mstate av, size_t bytes)
victim = av->top;
size = chunksize (victim);
+ if (__glibc_unlikely (size > av->system_mem))
+ malloc_printerr ("malloc(): corrupted top size");
+
if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
{
remainder_size = size - nb;
-----------------------------------------------------------------------
Summary of changes:
ChangeLog | 4 ++++
malloc/malloc.c | 3 +++
2 files changed, 7 insertions(+), 0 deletions(-)
hooks/post-receive
--
GNU C Library master sources