GNU C Library master sources branch release/2.28/master updated. glibc-2.28-38-g510a25f
Mon Nov 12 12:43:00 GMT 2018

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, release/2.28/master has been updated
       via  510a25f2d208e3b0c86f54b053f61c5b647e4b9b (commit)
      from  168035056eab9db4ee0e5d7f62060e111b86a0a4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------;a=commitdiff;h=510a25f2d208e3b0c86f54b053f61c5b647e4b9b

commit 510a25f2d208e3b0c86f54b053f61c5b647e4b9b
Author: Pochang Chen <>
Date:   Thu Aug 16 15:24:24 2018 -0400

    malloc: Verify size of top chunk.
    The House of Force is a well-known technique to exploit heap
    overflow. In essence, this exploit takes three steps:
    1. Overwrite the size of top chunk with very large value (e.g. -1).
    2. Request x bytes from top chunk. As the size of top chunk
       is corrupted, x can be arbitrarily large and top chunk will
       still be offset by x.
    3. The next allocation from top chunk will thus be controllable.
    If we verify the size of top chunk at step 2, we can stop such attack.
    (cherry picked from commit 30a17d8c95fbfb15c52d1115803b63aaa73a285c)

diff --git a/ChangeLog b/ChangeLog
index 88814e6..44795b2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2018-08-16  Pochang Chen  <>
+	* malloc/malloc.c (_int_malloc.c): Verify size of top chunk.
 2018-08-13  Joseph Myers  <>
 	* sysdeps/unix/sysv/linux/syscall-names.list: Update kernel
diff --git a/malloc/malloc.c b/malloc/malloc.c
index e247c77..9431108 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4076,6 +4076,9 @@ _int_malloc (mstate av, size_t bytes)
       victim = av->top;
       size = chunksize (victim);
+      if (__glibc_unlikely (size > av->system_mem))
+        malloc_printerr ("malloc(): corrupted top size");
       if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
           remainder_size = size - nb;


Summary of changes:
 ChangeLog       |    4 ++++
 malloc/malloc.c |    3 +++
 2 files changed, 7 insertions(+), 0 deletions(-)

GNU C Library master sources

More information about the Glibc-cvs mailing list