mailing list of musl libc
 help / color / mirror / code / Atom feed
* [musl] [PATCH v2] Add a safe dequeue integrity check for mallocng
@ 2023-09-16  7:08 James Raphael Tiovalen
  2023-09-16 14:58 ` jvoisin
  0 siblings, 1 reply; 3+ messages in thread
From: James Raphael Tiovalen @ 2023-09-16  7:08 UTC (permalink / raw)
  To: musl; +Cc: James Raphael Tiovalen

This commit adds an integrity check to allow for safer dequeuing of the
out-of-band meta structs in mallocng. If the unlikely condition is true
due to some sort of heap metadata corruption, we abort.

This approach is similar to the safe unlinking check performed by glibc.

While this check would not prevent more sophisticated attacks in more
specific scenarios, as shown by the historical exploitation efforts on
glibc, this check would prevent more basic heap metadata corruption
attacks from being successfully executed. Having this check here would
reduce the risk of pointer hijacking, mitigate the impact of
attacker-controlled `prev` and `next` pointers that could be obtained
via a vulnerable program, and restrict the tampering of other memory
regions via arbitrary write primitives.
v1 -> v2: Modify the check to an assert.
 src/malloc/mallocng/meta.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/malloc/mallocng/meta.h b/src/malloc/mallocng/meta.h
index 61ec53f9..847598b5 100644
--- a/src/malloc/mallocng/meta.h
+++ b/src/malloc/mallocng/meta.h
@@ -90,6 +90,7 @@ static inline void queue(struct meta **phead, struct meta *m)
 static inline void dequeue(struct meta **phead, struct meta *m)
 	if (m->next != m) {
+		assert(m->prev->next == m && m->next->prev == m);
 		m->prev->next = m->next;
 		m->next->prev = m->prev;
 		if (*phead == m) *phead = m->next;

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2023-09-16 16:11 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-09-16  7:08 [musl] [PATCH v2] Add a safe dequeue integrity check for mallocng James Raphael Tiovalen
2023-09-16 14:58 ` jvoisin
2023-09-16 16:11   ` Rich Felker

Code repositories for project(s) associated with this public inbox

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).