Blame SOURCES/glibc-rh1447556.patch
|
 |
00db10 |
From 17f487b7afa7cd6c316040f3e6c86dc96b2eec30 Mon Sep 17 00:00:00 2001
|
|
|
00db10 |
From: DJ Delorie <dj@delorie.com>
|
|
|
00db10 |
Date: Fri, 17 Mar 2017 15:31:38 -0400
|
|
|
00db10 |
Subject: [PATCH] Further harden glibc malloc metadata against 1-byte
|
|
|
00db10 |
overflows.
|
|
|
00db10 |
|
|
|
00db10 |
Additional check for chunk_size == next->prev->chunk_size in unlink()
|
|
|
00db10 |
|
|
|
00db10 |
2017-03-17 Chris Evans <scarybeasts@gmail.com>
|
|
|
00db10 |
|
|
|
00db10 |
* malloc/malloc.c (unlink): Add consistency check between size and
|
|
|
00db10 |
next->prev->size, to further harden against 1-byte overflows.
|
|
|
00db10 |
|
|
|
00db10 |
diff -rup a/malloc/malloc.c b/malloc/malloc.c
|
|
|
00db10 |
--- a/malloc/malloc.c 2017-08-01 18:11:00.000000000 -0400
|
|
|
00db10 |
+++ b/malloc/malloc.c 2017-08-01 18:13:07.907438098 -0400
|
|
|
00db10 |
@@ -1429,6 +1429,8 @@ typedef struct malloc_chunk* mbinptr;
|
|
|
00db10 |
|
|
|
00db10 |
/* Take a chunk off a bin list */
|
|
|
00db10 |
#define unlink(AV, P, BK, FD) { \
|
|
|
00db10 |
+ if (__builtin_expect (chunksize(P) != next_chunk(P)->prev_size, 0)) \
|
|
|
00db10 |
+ malloc_printerr (check_action, "corrupted size vs. prev_size", P, AV); \
|
|
|
00db10 |
FD = P->fd; \
|
|
|
00db10 |
BK = P->bk; \
|
|
|
00db10 |
if (__builtin_expect (FD->bk != P || BK->fd != P, 0)) { \
|