[PATCH] malloc: Add tcache list length integrity check

[just4you]

Signed-off-by: cyzq <fuchienfriedriceclub.hypnotist715@passinbox.com>---
 malloc/malloc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 5ca390cc22..205a54aa55 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -3329,6 +3329,8 @@ tcache_double_free_verify (tcache_entry *e)
    {
      if (cnt >= mp_.tcache_count)
        malloc_printerr ("free(): too many chunks detected in tcache");
+     if (cnt > tcache->counts[tc_idx])
+        malloc_printerr ("free(): tcache count mismatch");
      if (__glibc_unlikely (misaligned_mem (tmp)))
        malloc_printerr ("free(): unaligned chunk detected in tcache 2");
      if (tmp == e)
--
2.43.0

The above is my patch. I am a novice hacker. When I was learning tcache attacks, I noticed that the check in tcache_double_free_verify was not perfect. I wondered why the above check was not added, and I thought that adding the above check would not cause a big performance loss, so I submitted a patch to glibc. Of course, if you think the above check should not be added, if possible, I hope you can tell me the reason, because I want to know more about the glibc code.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20250718/88ce072e/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: publickey - just4you_jongun@protonmail.com - 0xA0C5999E.asc
Type: application/pgp-keys
Size: 868 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20250718/88ce072e/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 343 bytes
Desc: OpenPGP digital signature
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20250718/88ce072e/attachment-0001.sig>