free(3) const void *

[Xi Ruoyao]

On Fri, 2024-01-26 at 19:23 +0100, Alejandro Colomar wrote:
> So, after Xi's reminder, I'll reformulate my suggestion to
> 
> 	[[gnu::access(none)]]
> 	void free(const void *p);

It may defeat glibc.malloc.perturb, which will fill the freed buffer
with some junk bytes to detect UAF more easily.  Without the access
attribute the compiler will (definitely) read these junk bytes from the
freed buffer and hopefully make the program fail in a catastrophic way,
but with the access attribute the compiler may reuse the previously read
value stored in some registers, causing the UAF slip away.

And glibc.malloc.perturb is an environment variable set at runtime, so
we cannot do it via some #if...

-- 
Xi Ruoyao <xry111@xry111.site>
School of Aerospace Science and Technology, Xidian University