[PATCH] malloc: Improved double free detection in the tcache.

[Carlos O'Donell]

On 5/2/25 12:26 PM, Lau, David wrote:
> Problem:
> The previous double free detection did not account for an attacker to
> use a terminating null byte overflowing from the previous
> chunk to change the size of a memory chunk is being sorted into.
> So that the check in 'tcache_double_free_verify' would pass
> even though it is a double free.
> 
> Solution:
> Let 'tcache_double_free_verify' iterate over all tcache entries to
> detect double frees.
> 
> This patch only protects from buffer overflows by one byte.
> But I would argue that off by one errors are the most common
> errors to be made.
> 
> Alternatives Considered:
>    Store the size of a memory chunk in big endian and thus
>    the chunk size would not get overwritten because entries in the
>    tcache are not that big.
> 
>    Move the tcache_key before the actual memory chunk so that it
>    does not have to be checked at all, this would work better in general
>    but also it would increase the memory usage.
> 
> Signed-off-by:  David Lau <david.lau@fau.de>

David,

Thanks for submitting this patch! The patch doesn't apply currently and I'm
investigating it because it failed pre-commit CI:

https://patchwork.sourceware.org/project/glibc/patch/24697cee5e28aba11ac81d39b93ebb25@fau.de/

How did you send the patch to the list?

-- 
Cheers,
Carlos.