[Bug malloc/20080] New: Perform heap consistency check in malloc_usable_size

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=20080

            Bug ID: 20080
           Summary: Perform heap consistency check in malloc_usable_size
           Product: glibc
           Version: 2.24
            Status: NEW
          Severity: normal
          Priority: P2
         Component: malloc
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security-

We should perform cheap heap consistency checks in malloc_usable_size and abort
the process if the the pointer provably does not point to a live object.

The current logic which returns 0 if the pointer points to a valid, freed chunk
is bogus because after a chunk is freed, the implementation can reuse it in any
way it sees fit.  The pointer may well point straight into an other object, or
a larger freed chunk.  The application has no way of detecting this, so calling
malloc_usable_size with a dangling pointer is always invalid.

-- 
You are receiving this mail because:
You are on the CC list for the bug.