[PATCH] malloc: Check for large bin list corruption when inserting unsorted chunk

[Adam Maris]

On Tue, Feb 12, 2019 at 5:13 PM Adam Maris <amaris@redhat.com> wrote:
>
> Fixes bug 24216. This patch adds security checks for bk and bk_nextsize pointers
> of chunks in large bin when inserting chunk from unsorted bin. It was possible
> to write the pointer to victim (newly inserted chunk) to arbitrary memory
> locations if bk or bk_nextsize pointers of the next large bin chunk
> got corrupted.
>

Sending again with patch as attachment for better readability.

Best Regards,

Adam Mariš
-------------- next part --------------
A non-text attachment was scrubbed...
Name: frontlink.patch
Type: text/x-patch
Size: 928 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20190212/804d8164/attachment.bin>