From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/4427 Path: news.gmane.org!not-for-mail From: Szabolcs Nagy Newsgroups: gmane.linux.lib.musl.general Subject: Re: Re: NULL deref SEGV in malloc.c:unbin() Date: Sun, 29 Dec 2013 01:05:15 +0100 Message-ID: <20131229000511.GZ1685@port70.net> References: <20131227190544.GF24286@brightrain.aerifal.cx> <20131227221345.GG24286@brightrain.aerifal.cx> <20131229000112.GY1685@port70.net> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1388275520 27426 80.91.229.3 (29 Dec 2013 00:05:20 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sun, 29 Dec 2013 00:05:20 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-4431-gllmg-musl=m.gmane.org@lists.openwall.com Sun Dec 29 01:05:27 2013 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1Vx3sl-0006ib-EF for gllmg-musl@plane.gmane.org; Sun, 29 Dec 2013 01:05:27 +0100 Original-Received: (qmail 3324 invoked by uid 550); 29 Dec 2013 00:05:26 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 3313 invoked from network); 29 Dec 2013 00:05:26 -0000 Content-Disposition: inline In-Reply-To: <20131229000112.GY1685@port70.net> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:4427 Archived-At: * Szabolcs Nagy [2013-12-29 01:01:12 +0100]: > > so it seems the corruption starts before opendir > > it would be nice to see where 0x2139018 comes from and why > mal.binmap and mal.bin[40] aren't managed properly probably unrelated but i dont understand split = (void *)((char *)self + n); in pretrim and trim why is the n enough between the start of self and split chunks? (and not n + overhead)