[PATCH v2 1/7] malloc: Add check for top size corruption.

[Florian Weimer]

On 02/20/2018 02:45 PM, Florian Weimer wrote:
> On 01/16/2018 01:05 PM, Istvan Kurucsai wrote:
>>> Andreas already pointed out style issues.
>>>
>>> I'm somewhat surprised that we have accurate accounting in 
>>> av->system_mem.
>>>
>>> Furthermore, for non-main arenas, I think the check should be against 
>>> the
>>> size of a single heap, or maybe the minimum of av->system_mem and 
>>> that size.
>>
>> I thought about this and believe that we can ensure something more
>> strict: that the end of the top chunk is the same as the end of the
>> arena (contiguous main_arena case) or the heap (mmapped arena case),
>> see below. Tests passed but I'm a bit uncertain if these invariants
>> are always held.
>>
>>
>> Ensure that the end of the top chunk is the same as
>> Â  the end of the arena/heap.
>>
>> Â Â Â Â  * malloc/malloc.c (_int_malloc): Check top size.
>> ---
>> Â  malloc/malloc.c | 29 +++++++++++++++++++++++++++++
>> Â  1 file changed, 29 insertions(+)
>>
>> diff --git a/malloc/malloc.c b/malloc/malloc.c
>> index f5aafd2..fd0f001 100644
>> --- a/malloc/malloc.c
>> +++ b/malloc/malloc.c
>> @@ -2251,6 +2251,33 @@ do_check_malloc_state (mstate av)
>> Â  }
>> Â  #endif
>>
>> +static bool
>> +valid_top_chunk (mstate av, mchunkptr top)
>> +{
>> +Â  size_t size = chunksize(top);
>> +
>> +Â  assert (av);
> 
> I think we can drop that assert, it is implied by the pointer 
> dereference in the subsequent assert.
> 
>> +Â  assert (av->top != initial_top (av));
>> +
>> +Â  if (av == &main_arena)
>> +Â Â Â  {
>> +Â Â Â Â Â  if ((contiguous (&main_arena)
>> +Â Â Â Â Â Â Â Â Â  && __glibc_unlikely ((uintptr_t) top + size
>> +Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â  != (uintptr_t) mp_.sbrk_base + 
>> av->system_mem))
>> +Â Â Â Â Â Â Â Â Â  || (!contiguous (&main_arena)
>> +Â Â Â Â Â Â Â Â Â Â Â Â Â  && __glibc_unlikely (size > av->system_mem)))
>> +Â Â Â Â Â Â Â  return false;
>> +Â Â Â  }
>> +Â  else
>> +Â Â Â  {
>> +Â Â Â Â Â  heap_info *heap = heap_for_ptr (top);
>> +Â Â Â Â Â  uintptr_t heap_end = (uintptr_t) heap + heap->size;
>> +Â Â Â Â Â  if (__glibc_unlikely ((uintptr_t) top + size != heap_end))
>> +Â Â Â Â Â Â Â  return false;
>> +Â Â Â  }
>> +
>> +Â  return true;
>> +}
> 
> I wonder if it is possible to write this in a slightly clearer way.
> 
> Maybe add a nested if (contiguous (&main_arena)) for the first branch, 
> and directly return the value of the inner-most conditional?

Any further comments here?

Thanks,
Florian