mirror of
https://sourceware.org/git/glibc.git
synced 2024-11-23 21:40:12 +00:00
b8dd0f4278
* malloc/malloc.c (tcache_entry): Add key field. (tcache_put): Set it. (tcache_get): Likewise. (_int_free): Check for double free in tcache. * malloc/tst-tcfree1.c: New. * malloc/tst-tcfree2.c: New. * malloc/Makefile: Run the new tests. * manual/probes.texi: Document memory_tcache_double_free probe. * dlfcn/dlerror.c (check_free): Prevent double frees. (cherry picked from commitbcdaad21d4) malloc: tcache: Validate tc_idx before checking for double-frees [BZ #23907] The previous check could read beyond the end of the tcache entry array. If the e->key == tcache cookie check happened to pass, this would result in crashes. (cherry picked from commitaffec03b71)
49 lines
1.4 KiB
C
49 lines
1.4 KiB
C
/* Test that malloc tcache catches double free.
|
|
Copyright (C) 2018 Free Software Foundation, Inc.
|
|
This file is part of the GNU C Library.
|
|
|
|
The GNU C Library is free software; you can redistribute it and/or
|
|
modify it under the terms of the GNU Lesser General Public
|
|
License as published by the Free Software Foundation; either
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
The GNU C Library is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
License along with the GNU C Library; if not, see
|
|
<http://www.gnu.org/licenses/>. */
|
|
|
|
#include <errno.h>
|
|
#include <error.h>
|
|
#include <limits.h>
|
|
#include <malloc.h>
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <sys/signal.h>
|
|
|
|
static int
|
|
do_test (void)
|
|
{
|
|
char * volatile ptrs[20];
|
|
int i;
|
|
|
|
/* Allocate enough small chunks so that when we free them all, the tcache
|
|
is full, and the first one we freed is at the end of its linked list. */
|
|
#define COUNT 20
|
|
for (i=0; i<COUNT; i++)
|
|
ptrs[i] = malloc (20);
|
|
for (i=0; i<COUNT; i++)
|
|
free (ptrs[i]);
|
|
free (ptrs[0]);
|
|
|
|
printf("FAIL: tcache double free\n");
|
|
return 1;
|
|
}
|
|
|
|
#define TEST_FUNCTION do_test
|
|
#define EXPECTED_SIGNAL SIGABRT
|
|
#include <support/test-driver.c>
|