[PATCH] malloc/malloc.c: Mitigate null-byte overflow attacks

[Florian Weimer]

On 11/03/2017 10:56 PM, Moritz Eckert wrote:
>>> Alternately, a simple XOR with a magic number means a set-to-zero 
>>> would un-XOR to a horribly wrong new "size".  Even a fixed magic 
>>> number would increase hackability significantly, although a 
>>> per-process one would be better (and more expensive to do at runtime, 
>>> unfortunately).
>>
>> See my old heap protector patches.  You could probably swap in bswap 
>> in place of the encryption, and it will just work.
> 
> Where do I find those patches?

I posted them here:

   https://sourceware.org/ml/libc-alpha/2016-10/msg00531.html

There probably has been some code drift, so the patch won't apply as-is.

Florian