malloc: Verify size of top chunk.

The House of Force is a well-known technique to exploit heap
overflow. In essence, this exploit takes three steps:
1. Overwrite the size of top chunk with very large value (e.g. -1).
2. Request x bytes from top chunk. As the size of top chunk
   is corrupted, x can be arbitrarily large and top chunk will
   still be offset by x.
3. The next allocation from top chunk will thus be controllable.

If we verify the size of top chunk at step 2, we can stop such attack.

(cherry picked from commit 30a17d8c95fbfb15c52d1115803b63aaa73a285c)

diff --git a/ChangeLog b/ChangeLog
index 88814e694787f801846845ab25e5b245b30ec956..44795b2e61c78f32bf58f5b81e4dc500e2789a57 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2018-08-16  Pochang Chen  <johnchen902@gmail.com>
+
+       * malloc/malloc.c (_int_malloc.c): Verify size of top chunk.
+
 2018-08-13  Joseph Myers  <joseph@codesourcery.com>
 
        * sysdeps/unix/sysv/linux/syscall-names.list: Update kernel

diff --git a/malloc/malloc.c b/malloc/malloc.c
index e247c77b7d4de26e0f2fbec16e352889bac3781b..9431108626cdc0b5c1972ee00126228c8dd7166f 100644 (file)
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4076,6 +4076,9 @@ _int_malloc (mstate av, size_t bytes)
       victim = av->top;
       size = chunksize (victim);
 
+      if (__glibc_unlikely (size > av->system_mem))
+        malloc_printerr ("malloc(): corrupted top size");
+
       if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))
         {
           remainder_size = size - nb;