[PATCH][BZ #1349] Return requested size for malloc_usable_size when MALLOC_CHECK_ > 0

Florian Weimer fweimer@redhat.com
Fri Aug 31 13:13:00 GMT 2012


On 08/31/2012 03:02 PM, Siddhesh Poyarekar wrote:

> When MALLOC_CHECK_ is exported as a positive value (which I am doing
> for this test), malloc_usable_size should return exactly 7, since the
> malloc_check code adds a magic number at p[7] if p is the mem pointer.
> Anything greater than that and the user may risk writing over the magic
> value and tripping an assertion during free.

The "7" depends on malloc allocation granularity.  On x86_64, the magic 
number is not 7, but 23, and malloc_usable_size(malloc(7)) == 24.

I'm not sure how to test this in a robust manner.  Perhaps you could use 
a loop and look for a bumo in malloc_usable_size, and make sure that the 
size after the bump is not divisible by 4?

-- 
Florian Weimer / Red Hat Product Security Team



More information about the Libc-alpha mailing list