|
 |
077c9d |
commit affec03b713c82c43a5b025dddc21bde3334f41e
|
|
|
077c9d |
Author: Florian Weimer <fweimer@redhat.com>
|
|
|
077c9d |
Date: Mon Nov 26 20:06:37 2018 +0100
|
|
|
077c9d |
|
|
|
077c9d |
malloc: tcache: Validate tc_idx before checking for double-frees [BZ #23907]
|
|
|
077c9d |
|
|
|
077c9d |
The previous check could read beyond the end of the tcache entry
|
|
|
077c9d |
array. If the e->key == tcache cookie check happened to pass, this
|
|
|
077c9d |
would result in crashes.
|
|
|
077c9d |
|
|
|
077c9d |
diff --git a/malloc/malloc.c b/malloc/malloc.c
|
|
|
077c9d |
index c6b0282e783eaeea..13c52f376859562d 100644
|
|
|
077c9d |
--- a/malloc/malloc.c
|
|
|
077c9d |
+++ b/malloc/malloc.c
|
|
|
077c9d |
@@ -4159,33 +4159,33 @@ _int_free (mstate av, mchunkptr p, int have_lock)
|
|
|
077c9d |
#if USE_TCACHE
|
|
|
077c9d |
{
|
|
|
077c9d |
size_t tc_idx = csize2tidx (size);
|
|
|
077c9d |
-
|
|
|
077c9d |
- /* Check to see if it's already in the tcache. */
|
|
|
077c9d |
- tcache_entry *e = (tcache_entry *) chunk2mem (p);
|
|
|
077c9d |
-
|
|
|
077c9d |
- /* This test succeeds on double free. However, we don't 100%
|
|
|
077c9d |
- trust it (it also matches random payload data at a 1 in
|
|
|
077c9d |
- 2^<size_t> chance), so verify it's not an unlikely coincidence
|
|
|
077c9d |
- before aborting. */
|
|
|
077c9d |
- if (__glibc_unlikely (e->key == tcache && tcache))
|
|
|
077c9d |
+ if (tcache != NULL && tc_idx < mp_.tcache_bins)
|
|
|
077c9d |
{
|
|
|
077c9d |
- tcache_entry *tmp;
|
|
|
077c9d |
- LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
|
|
|
077c9d |
- for (tmp = tcache->entries[tc_idx];
|
|
|
077c9d |
- tmp;
|
|
|
077c9d |
- tmp = tmp->next)
|
|
|
077c9d |
- if (tmp == e)
|
|
|
077c9d |
- malloc_printerr ("free(): double free detected in tcache 2");
|
|
|
077c9d |
- /* If we get here, it was a coincidence. We've wasted a few
|
|
|
077c9d |
- cycles, but don't abort. */
|
|
|
077c9d |
- }
|
|
|
077c9d |
+ /* Check to see if it's already in the tcache. */
|
|
|
077c9d |
+ tcache_entry *e = (tcache_entry *) chunk2mem (p);
|
|
|
077c9d |
+
|
|
|
077c9d |
+ /* This test succeeds on double free. However, we don't 100%
|
|
|
077c9d |
+ trust it (it also matches random payload data at a 1 in
|
|
|
077c9d |
+ 2^<size_t> chance), so verify it's not an unlikely
|
|
|
077c9d |
+ coincidence before aborting. */
|
|
|
077c9d |
+ if (__glibc_unlikely (e->key == tcache))
|
|
|
077c9d |
+ {
|
|
|
077c9d |
+ tcache_entry *tmp;
|
|
|
077c9d |
+ LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
|
|
|
077c9d |
+ for (tmp = tcache->entries[tc_idx];
|
|
|
077c9d |
+ tmp;
|
|
|
077c9d |
+ tmp = tmp->next)
|
|
|
077c9d |
+ if (tmp == e)
|
|
|
077c9d |
+ malloc_printerr ("free(): double free detected in tcache 2");
|
|
|
077c9d |
+ /* If we get here, it was a coincidence. We've wasted a
|
|
|
077c9d |
+ few cycles, but don't abort. */
|
|
|
077c9d |
+ }
|
|
|
077c9d |
|
|
|
077c9d |
- if (tcache
|
|
|
077c9d |
- && tc_idx < mp_.tcache_bins
|
|
|
077c9d |
- && tcache->counts[tc_idx] < mp_.tcache_count)
|
|
|
077c9d |
- {
|
|
|
077c9d |
- tcache_put (p, tc_idx);
|
|
|
077c9d |
- return;
|
|
|
077c9d |
+ if (tcache->counts[tc_idx] < mp_.tcache_count)
|
|
|
077c9d |
+ {
|
|
|
077c9d |
+ tcache_put (p, tc_idx);
|
|
|
077c9d |
+ return;
|
|
|
077c9d |
+ }
|
|
|
077c9d |
}
|
|
|
077c9d |
}
|
|
|
077c9d |
#endif
|