[PATCH] malloc: check tcachebin size when allocating

[dudududumaxver@gmail.com]

From: dbgbgtf <dudududuMaxVer@gmail.com>

check if `tcache mem size == request size` to avoid arbitrary mem
allocation.

this check will make sure wrong sized chunk doesn't come out from
tcache.

I don't know how can i test how much this check costs, i tried
mimalloc-bench, but it doesn't seems be able to test different libc.so.
some suggestion or support will be appreciate.

Signed-off-by: jingyun chen <dudududuMaxVer@gmail.com>
---
 malloc/malloc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/malloc/malloc.c b/malloc/malloc.c
index a0bc733482..cbed1d6be3 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3429,10 +3429,16 @@ void *
 __libc_malloc (size_t bytes)
 {
 #if USE_TCACHE
-  size_t tc_idx = csize2tidx (checked_request2size (bytes));
+  size_t tbytes = checked_request2size (bytes);
+  size_t tc_idx = csize2tidx (tbytes);
 
   if (tcache_available (tc_idx))
-    return tag_new_usable (tcache_get (tc_idx));
+  {
+    void *memptr = tag_new_usable (tcache_get (tc_idx));
+    if (__glibc_unlikely(chunksize(mem2chunk(memptr))) != tbytes)
+      malloc_printerr("malloc(): tcache mem size vs request size");
+    return memptr;
+  }
 #endif
 
   return __libc_malloc2 (bytes);
-- 
2.49.0