[PATCH v4 2/7] malloc: mangle tcache entries pointers
DJ Delorie
dj@redhat.com
Fri Mar 14 23:47:05 GMT 2025
Cupertino Miranda <cupertino.miranda@oracle.com> writes:
> - while (tcache_tmp->entries[i])
> + while (REVEAL_PTR (tcache_tmp->entries[i]))
Do we really want to protect the NULL entries? Doing that makes it much
easier for an attacker to get the protection key, as most entries would
be protected NULL at first. (although the key is just the address of
the entries array itself, so I guess you'd already have some way to get it).
The patch otherwise looks OK to me though.
Reviewed-by: DJ Delorie <dj@redhat.com>
More information about the Libc-alpha
mailing list