[musl] [PATCH v2] Add a safe dequeue integrity check for mallocng

[James Raphael Tiovalen <jamestiotio@gmail.com>]

This commit adds an integrity check to allow for safer dequeuing of the
out-of-band meta structs in mallocng. If the unlikely condition is true
due to some sort of heap metadata corruption, we abort.

This approach is similar to the safe unlinking check performed by glibc.

While this check would not prevent more sophisticated attacks in more
specific scenarios, as shown by the historical exploitation efforts on
glibc, this check would prevent more basic heap metadata corruption
attacks from being successfully executed. Having this check here would
reduce the risk of pointer hijacking, mitigate the impact of
attacker-controlled `prev` and `next` pointers that could be obtained
via a vulnerable program, and restrict the tampering of other memory
regions via arbitrary write primitives.
---
v1 -> v2: Modify the check to an assert.
---
 src/malloc/mallocng/meta.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/malloc/mallocng/meta.h b/src/malloc/mallocng/meta.h
index 61ec53f9..847598b5 100644
--- a/src/malloc/mallocng/meta.h
+++ b/src/malloc/mallocng/meta.h
@@ -90,6 +90,7 @@ static inline void queue(struct meta **phead, struct meta *m)
 static inline void dequeue(struct meta **phead, struct meta *m)
 {
 	if (m->next != m) {
+		assert(m->prev->next == m && m->next->prev == m);
 		m->prev->next = m->next;
 		m->next->prev = m->prev;
 		if (*phead == m) *phead = m->next;
--
2.42.0