[PATCH] malloc: check tcachebin size when allocating.

[Florian Weimer]

> From: dbgbgtf <dudududuMaxVer@outlook.com>
>
> check if `tcache mem size == request size` to avoid arbitrary tcachebin
> allocation.

Do you have a copyright assignment with the FSF?  If not, please read

<https://sourceware.org/glibc/wiki/Contribution%20checklist#Developer_Certificate_of_Origin>

and verify if you can resubmit your patch under those terms, along with
a suitable Signed-off-by: line.

> +/* Convert a user mem pointer to chunk size */
> +#define mem2size(mem) ((*(INTERNAL_SIZE_T*)((char*)mem - SIZE_SZ)) & ~MALLOC_ALIGN_MASK )

I think that's just chunk_size (mem2chunk (mem)).  Maybe use that
instead?

> +
>  /* The smallest possible chunk */
>  #define MIN_CHUNK_SIZE        (offsetof(struct malloc_chunk, fd_nextsize))
>  
> @@ -3429,10 +3432,16 @@ void *
>  __libc_malloc (size_t bytes)
>  {
>  #if USE_TCACHE
> -  size_t tc_idx = csize2tidx (checked_request2size (bytes));
> +  size_t tbytes = checked_request2size (bytes);
> +  size_t tc_idx = csize2tidx (tbytes);
>  
>    if (tcache_available (tc_idx))
> -    return tag_new_usable (tcache_get (tc_idx));
> +  {
> +    void *memptr = tag_new_usable (tcache_get (tc_idx));
> +    if (__glibc_unlikely(mem2size(memptr)) != tbytes)
> +      malloc_printerr("malloc(): tcache mem size vs request2 size");
> +    return memptr;

So I think intent here is that even with heap corruption, wrongly sized
chunks do not come out of tcache?  I wonder how much that extra check
costs.

Thanks,
Florian