[PATCH] malloc/malloc.c: Mitigate null-byte overflow attacks

[Moritz Eckert]

>>> I wonder if we should add a "size_is_sane()" macro to check for
>>> unreasonable sizes before we use them to compute pointers.
>> That sounds like a good idea to me. Would you prefer a separate macro
>> for prev_size and size that only gets the current chunk as a parameter or
>> a single macro that gets a parameter what to check for?
> I don't know, I was just wondering if there were some other way to
> determine that a size has been corrupted other than consistency checks.
Oh I see. I thought you meant a "size_is_sane()" macro, for doing 
consistency checks whenever
using size or prev_size to calculate a chunk pointer.
Unfortunately, this would also have a problem with "forward" 
calculations, since the prev_size is only set for free
chunks and therefore, can't be always verified. Nevertheless, such a 
macro could make my patch look cleaner, since there is
only one central spot for the check.