mailing list of musl libc
 help / color / mirror / code / Atom feed
From: James Raphael Tiovalen <>
Cc: James Raphael Tiovalen <>
Subject: [musl] [PATCH v2] Add a safe dequeue integrity check for mallocng
Date: Sat, 16 Sep 2023 15:08:24 +0800	[thread overview]
Message-ID: <> (raw)

This commit adds an integrity check to allow for safer dequeuing of the
out-of-band meta structs in mallocng. If the unlikely condition is true
due to some sort of heap metadata corruption, we abort.

This approach is similar to the safe unlinking check performed by glibc.

While this check would not prevent more sophisticated attacks in more
specific scenarios, as shown by the historical exploitation efforts on
glibc, this check would prevent more basic heap metadata corruption
attacks from being successfully executed. Having this check here would
reduce the risk of pointer hijacking, mitigate the impact of
attacker-controlled `prev` and `next` pointers that could be obtained
via a vulnerable program, and restrict the tampering of other memory
regions via arbitrary write primitives.
v1 -> v2: Modify the check to an assert.
 src/malloc/mallocng/meta.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/malloc/mallocng/meta.h b/src/malloc/mallocng/meta.h
index 61ec53f9..847598b5 100644
--- a/src/malloc/mallocng/meta.h
+++ b/src/malloc/mallocng/meta.h
@@ -90,6 +90,7 @@ static inline void queue(struct meta **phead, struct meta *m)
 static inline void dequeue(struct meta **phead, struct meta *m)
 	if (m->next != m) {
+		assert(m->prev->next == m && m->next->prev == m);
 		m->prev->next = m->next;
 		m->next->prev = m->prev;
 		if (*phead == m) *phead = m->next;

             reply	other threads:[~2023-09-16  7:09 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-09-16  7:08 James Raphael Tiovalen [this message]
2023-09-16 14:58 ` jvoisin
2023-09-16 16:11   ` Rich Felker

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).