[PATCH] malloc: check tcache mem size in tcache_get_n to avoid arbitrary mem allocation

[DJ Delorie]

dbgbgtf <dudududumaxver@gmail.com> writes:

> If you want to prove that the check in tcache_put is necessary, please
> write a testcase and demonstrate that my check does not prevent it.

I'm not here to prove anything, nor was my comment intended to be a
review of your patch.  I was just trying to provide some insight into
why we might have more checks than seem reasonable in some places, and
fewer checks than reasonable in others.  I apologize if my comments came
across as anything else; I'm just trying to make everyone aware that
there are *many* factors in play in a subsystem like malloc, where it's
(1) very popular in apps, (2) critical for performance, and (3) a
valuable target for hackers.

> And if your testcase cann't result in an arbitrary memory allocation
> caused by a corrupted linked list in tcachebin,

It's not just about testcases; if we're writing the test code we can do
pretty much anything we want.  It's about what kinds of operations a
hacker can do through other means, such as corrupt input data or ROP
chaining, when they're *not* the ones writing the "test" code.  Checks
for those types of "corruption" have higher importance.

> Again, I apologize if my words came across as impolite.

I suspect we're just having the usual communication issues, no
worries :-)