[PATCH] malloc: check tcache mem size in tcache_get_n to avoid arbitrary mem allocation

[DJ Delorie]

dbgbgtf <dudududumaxver@gmail.com> writes:
>> The goal is to detect heap corruption cheaply and as early as possible.
>
> I understood, but checks in `tcache_put` is too early.

We need checks on both put and get, depending on the type of exploit
we're guarding against.

> And hackers can break the pointer swizzing after `tcache_put` easily.

At some point, we have to assume if a hacker can do XYZ, they can do far
worse things without bothering to corrupt memory first.  Our protection
in tcache needs to balance risk vs performance, even more so than the
main malloc code.  By that I mean if we make tcache so paranoid that
it's slower than not using tcache, we've lost.