diff mbox series

malloc: tcache_get() may return another valid memory block

Message ID FCFCADD62FC0CA4FAEA05F13220975B01FACCBA3@dggeml525-mbx.china.huawei.com
State New, archived
Headers
Series malloc: tcache_get() may return another valid memory block |

Commit Message

wangxu May 8, 2020, 12:02 p.m. UTC 
  Hi,

The malloc function in the GNU C Library (aka glibc or libc6) since
2.26, may return a memory block which contain another valid memory block
pointer, potentially leading to memory leak. 

This occurs because the function tcache_get() of per-thread cache (aka tcache) feature 
does not set e->next = NULL.

with Safe-Linking support, the memory block pointer can be disclosed by REVEAL_PTR(&p).

---
 malloc/malloc.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Florian Weimer May 8, 2020, 12:14 p.m. UTC | #1 
* wangxu:

> The malloc function in the GNU C Library (aka glibc or libc6) since
> 2.26, may return a memory block which contain another valid memory
> block pointer, potentially leading to memory leak.

Do you mean “memory leak” as in “information disclosure”?

Thanks,
Florian
diff mbox series

Patch

diff --git a/malloc/malloc.c b/malloc/malloc.c
index ee87ddb..8dfb20b 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2954,6 +2954,7 @@  tcache_get (size_t tc_idx)
   tcache->entries[tc_idx] = REVEAL_PTR (e->next);
   --(tcache->counts[tc_idx]);
   e->key = NULL;
+  e->next = NULL;
   return (void *) e;
 }