Skip to content

Commit c6a55fe

Browse files
Kyle-KyleKyle-Kyle
authored
Merge pull request #184 from gfelber/master
fixed sysmalloc_int_free.c MALLOC_ALIGN
2 parents 385b8b3 + 31bd3ba commit c6a55fe

File tree

12 files changed

+10
-30
lines changed

12 files changed

+10
-30
lines changed

‎glibc_2.23/sysmalloc_int_free.c

-5
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99
#define SIZE_SZ sizeof(size_t)
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
12-
// same for x86_64 and x86
1312
#define MALLOC_ALIGN (SIZE_SZ*2)
1413
#define MALLOC_MASK (-MALLOC_ALIGN)
1514

@@ -28,10 +27,6 @@
2827
/**
2928
* Tested on:
3029
* + GLIBC 2.23 (x86_64, x86 & aarch64)
31-
* + GLIBC 2.39 (x86_64, x86 & aarch64)
32-
* + GLIBC 2.34 (x86_64, x86 & aarch64)
33-
* + GLIBC 2.31 (x86_64, x86 & aarch64)
34-
* + GLIBC 2.27 (x86_64, x86 & aarch64)
3530
*
3631
* sysmalloc allows us to free() the top chunk of heap to create nearly arbitrary bins,
3732
* which can be used to corrupt heap without needing to call free() directly.

‎glibc_2.24/sysmalloc_int_free.c

-5
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@
99
#define SIZE_SZ sizeof(size_t)
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
12-
// same for x86_64 and x86
1312
#define MALLOC_ALIGN (SIZE_SZ*2)
1413
#define MALLOC_MASK (-MALLOC_ALIGN)
1514

@@ -28,10 +27,6 @@
2827
/**
2928
* Tested on:
3029
* + GLIBC 2.23 (x86_64, x86 & aarch64)
31-
* + GLIBC 2.39 (x86_64, x86 & aarch64)
32-
* + GLIBC 2.34 (x86_64, x86 & aarch64)
33-
* + GLIBC 2.31 (x86_64, x86 & aarch64)
34-
* + GLIBC 2.27 (x86_64, x86 & aarch64)
3530
*
3631
* sysmalloc allows us to free() the top chunk of heap to create nearly arbitrary bins,
3732
* which can be used to corrupt heap without needing to call free() directly.

‎glibc_2.27/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

‎glibc_2.31/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

‎glibc_2.32/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

‎glibc_2.33/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

‎glibc_2.34/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

‎glibc_2.35/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

‎glibc_2.36/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

‎glibc_2.37/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

‎glibc_2.38/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

‎glibc_2.39/sysmalloc_int_free.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
#define CHUNK_HDR_SZ (SIZE_SZ*2)
1212
// same for x86_64 and x86
13-
#define MALLOC_ALIGN (SIZE_SZ*2)
13+
#define MALLOC_ALIGN 0x10
1414
#define MALLOC_MASK (-MALLOC_ALIGN)
1515

1616
#define PAGESIZE sysconf(_SC_PAGESIZE)
@@ -27,7 +27,6 @@
2727

2828
/**
2929
* Tested on:
30-
* + GLIBC 2.23 (x86_64, x86 & aarch64)
3130
* + GLIBC 2.39 (x86_64, x86 & aarch64)
3231
* + GLIBC 2.34 (x86_64, x86 & aarch64)
3332
* + GLIBC 2.31 (x86_64, x86 & aarch64)

0 commit comments

Comments
 (0)