[musl] [PATCH] Add a safe dequeue integrity check for mallocng

[James Raphael Tiovalen <jamestiotio@gmail.com>]

This commit adds an integrity check to allow for safer dequeuing of meta
structs in mallocng. If the unlikely condition is true due to some sort
of heap corruption, we print an error message and abort.

This approach is similar to the safe unlinking check performed by glibc.

While this check would not prevent more sophisticated attacks in more
specific scenarios, as shown by the historical exploitation efforts on
glibc, this check would prevent more basic heap corruption attacks from
being successfully executed.
---
 src/malloc/mallocng/meta.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/malloc/mallocng/meta.h b/src/malloc/mallocng/meta.h
index 61ec53f9..57946d01 100644
--- a/src/malloc/mallocng/meta.h
+++ b/src/malloc/mallocng/meta.h
@@ -2,9 +2,11 @@
 #define MALLOC_META_H
 
 #include <stdint.h>
+#include <stdio.h>
 #include <errno.h>
 #include <limits.h>
 #include "glue.h"
+#include "libm.h"
 
 __attribute__((__visibility__("hidden")))
 extern const uint16_t size_classes[];
@@ -90,6 +92,10 @@ static inline void queue(struct meta **phead, struct meta *m)
 static inline void dequeue(struct meta **phead, struct meta *m)
 {
 	if (m->next != m) {
+		if (predict_false(m->prev->next != m || m->next->prev != m)) {
+			fprintf(stderr, "Corrupted doubly-linked meta list\n");
+			abort();
+		}
 		m->prev->next = m->next;
 		m->next->prev = m->prev;
 		if (*phead == m) *phead = m->next;
-- 
2.42.0