[PATCH] malloc/malloc.c: Mitigate null-byte overflow attacks

[Moritz Eckert]

>>> I wonder if we should add a "size_is_sane()" macro to check for
>>> unreasonable sizes before we use them to compute pointers.
>> That sounds like a good idea to me. Would you prefer a separate macro
>> for prev_size and size that only gets the current chunk as a parameter or
>> a single macro that gets a parameter what to check for?
> 
> I don't know, I was just wondering if there were some other way to
> determine that a size has been corrupted other than consistency checks.

Here would be my idea for a macro. Do you like that better?

The macro could also do the whole stepping backward in memory, as in 
"prev_chunk_secure(p)", which points p to the prev_chunk or
aborts otherwise.

Also would you prefer to keep the current check in unlink, or remove it 
entirely?


-------------- next part --------------
A non-text attachment was scrubbed...
Name: patch
Type: text/x-patch
Size: 983 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20171027/ad38a3c6/attachment.bin>