aboutsummaryrefslogtreecommitdiff
path: root/malloc
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2018-11-26 20:06:37 +0100
committerFlorian Weimer <fweimer@redhat.com>2018-11-26 20:06:37 +0100
commitaffec03b713c82c43a5b025dddc21bde3334f41e (patch)
tree3026478268be021b7ba6d0d2650ce511cbf588b4 /malloc
parent8ae74eadb60eb36424e4605939cef5fc966724be (diff)
downloadglibc-affec03b713c82c43a5b025dddc21bde3334f41e.tar
glibc-affec03b713c82c43a5b025dddc21bde3334f41e.tar.gz
glibc-affec03b713c82c43a5b025dddc21bde3334f41e.tar.bz2
glibc-affec03b713c82c43a5b025dddc21bde3334f41e.zip
malloc: tcache: Validate tc_idx before checking for double-frees [BZ #23907]
The previous check could read beyond the end of the tcache entry array. If the e->key == tcache cookie check happened to pass, this would result in crashes.
Diffstat (limited to 'malloc')
-rw-r--r--malloc/malloc.c50
1 files changed, 25 insertions, 25 deletions
diff --git a/malloc/malloc.c b/malloc/malloc.c
index f730d7a2ee..c9b2c6e320 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4225,33 +4225,33 @@ _int_free (mstate av, mchunkptr p, int have_lock)
#if USE_TCACHE
{
size_t tc_idx = csize2tidx (size);
-
- /* Check to see if it's already in the tcache. */
- tcache_entry *e = (tcache_entry *) chunk2mem (p);
-
- /* This test succeeds on double free. However, we don't 100%
- trust it (it also matches random payload data at a 1 in
- 2^<size_t> chance), so verify it's not an unlikely coincidence
- before aborting. */
- if (__glibc_unlikely (e->key == tcache && tcache))
+ if (tcache != NULL && tc_idx < mp_.tcache_bins)
{
- tcache_entry *tmp;
- LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
- for (tmp = tcache->entries[tc_idx];
- tmp;
- tmp = tmp->next)
- if (tmp == e)
- malloc_printerr ("free(): double free detected in tcache 2");
- /* If we get here, it was a coincidence. We've wasted a few
- cycles, but don't abort. */
- }
+ /* Check to see if it's already in the tcache. */
+ tcache_entry *e = (tcache_entry *) chunk2mem (p);
+
+ /* This test succeeds on double free. However, we don't 100%
+ trust it (it also matches random payload data at a 1 in
+ 2^<size_t> chance), so verify it's not an unlikely
+ coincidence before aborting. */
+ if (__glibc_unlikely (e->key == tcache))
+ {
+ tcache_entry *tmp;
+ LIBC_PROBE (memory_tcache_double_free, 2, e, tc_idx);
+ for (tmp = tcache->entries[tc_idx];
+ tmp;
+ tmp = tmp->next)
+ if (tmp == e)
+ malloc_printerr ("free(): double free detected in tcache 2");
+ /* If we get here, it was a coincidence. We've wasted a
+ few cycles, but don't abort. */
+ }
- if (tcache
- && tc_idx < mp_.tcache_bins
- && tcache->counts[tc_idx] < mp_.tcache_count)
- {
- tcache_put (p, tc_idx);
- return;
+ if (tcache->counts[tc_idx] < mp_.tcache_count)
+ {
+ tcache_put (p, tc_idx);
+ return;
+ }
}
}
#endif