malloc: tcache: Validate tc_idx before checking for double-frees [BZ #23907]
The previous check could read beyond the end of the tcache entry array. If the e->key == tcache cookie check happened to pass, this would result in crashes.
This commit is contained in:
parent
8ae74eadb6
commit
affec03b71
|
@ -1,3 +1,9 @@
|
||||||
|
2018-11-26 Florian Weimer <fweimer@redhat.com>
|
||||||
|
|
||||||
|
[BZ #23907]
|
||||||
|
* malloc/malloc.c (_int_free): Validate tc_idx before checking for
|
||||||
|
double-frees.
|
||||||
|
|
||||||
2018-11-26 Rafael Ávila de Espíndola <rafael@espindo.la>
|
2018-11-26 Rafael Ávila de Espíndola <rafael@espindo.la>
|
||||||
|
|
||||||
[BZ #19767]
|
[BZ #19767]
|
||||||
|
|
|
@ -4225,33 +4225,33 @@ _int_free (mstate av, mchunkptr p, int have_lock)
|
||||||
#if USE_TCACHE
|
#if USE_TCACHE
|
||||||
{
|
{
|
||||||
size_t tc_idx = csize2tidx (size);
|
size_t tc_idx = csize2tidx (size);
|
||||||
|
if (tcache != NULL && tc_idx < mp_.tcache_bins)
|
||||||
/* Check to see if it's already in the tcache. */
|
|
||||||
tcache_entry *e = (tcache_entry *) chunk2mem (p);
|
|
||||||
|
|
||||||
/* This test succeeds on double free. However, we don't 100%
|
|
||||||
trust it (it also matches random payload data at a 1 in
|
|
||||||
2^<size_t> chance), so verify it's not an unlikely coincidence
|
|
||||||
before aborting. */
|
|
||||||
if (__glibc_unlikely (e->key == tcache && tcache))
|
|
||||||
{
|
{
|
||||||
tcache_entry *tmp;
|
/* Check to see if it's already in the tcache. */
|
||||||
LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
|
tcache_entry *e = (tcache_entry *) chunk2mem (p);
|
||||||
for (tmp = tcache->entries[tc_idx];
|
|
||||||
tmp;
|
|
||||||
tmp = tmp->next)
|
|
||||||
if (tmp == e)
|
|
||||||
malloc_printerr ("free(): double free detected in tcache 2");
|
|
||||||
/* If we get here, it was a coincidence. We've wasted a few
|
|
||||||
cycles, but don't abort. */
|
|
||||||
}
|
|
||||||
|
|
||||||
if (tcache
|
/* This test succeeds on double free. However, we don't 100%
|
||||||
&& tc_idx < mp_.tcache_bins
|
trust it (it also matches random payload data at a 1 in
|
||||||
&& tcache->counts[tc_idx] < mp_.tcache_count)
|
2^<size_t> chance), so verify it's not an unlikely
|
||||||
{
|
coincidence before aborting. */
|
||||||
tcache_put (p, tc_idx);
|
if (__glibc_unlikely (e->key == tcache))
|
||||||
return;
|
{
|
||||||
|
tcache_entry *tmp;
|
||||||
|
LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
|
||||||
|
for (tmp = tcache->entries[tc_idx];
|
||||||
|
tmp;
|
||||||
|
tmp = tmp->next)
|
||||||
|
if (tmp == e)
|
||||||
|
malloc_printerr ("free(): double free detected in tcache 2");
|
||||||
|
/* If we get here, it was a coincidence. We've wasted a
|
||||||
|
few cycles, but don't abort. */
|
||||||
|
}
|
||||||
|
|
||||||
|
if (tcache->counts[tc_idx] < mp_.tcache_count)
|
||||||
|
{
|
||||||
|
tcache_put (p, tc_idx);
|
||||||
|
return;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
Loading…
Reference in New Issue