Security Checks
This presents a summary of the security checks introduced in glibc's implementation to detect and prevent heap related attacks.
Function | Security Check | Error |
unlink | Whether chunk size is equal to the previous size set in the next chunk (in memory) | corrupted size vs. prev_size |
unlink | Whether | corrupted double-linked list |
_int_malloc | While removing the first chunk from fastbin (to service a malloc request), check whether the size of the chunk falls in fast chunk size range | malloc(): memory corruption (fast) |
_int_malloc | While removing the last chunk ( | malloc(): smallbin double linked list corrupted |
_int_malloc | While iterating in unsorted bin, check whether size of current chunk is within minimum ( | malloc(): memory corruption |
_int_malloc | While inserting last remainder chunk into unsorted bin (after splitting a large chunk), check whether | malloc(): corrupted unsorted chunks |
_int_malloc | While inserting last remainder chunk into unsorted bin (after splitting a fast or a small chunk), check whether | malloc(): corrupted unsorted chunks 2 |
_int_free | Check whether | free(): invalid pointer |
_int_free | Check whether the chunk is at least of size | free(): invalid size |
_int_free | For a chunk with size in fastbin range, check if next chunk's size is between minimum and maximum size ( | free(): invalid next size (fast) |
_int_free | While inserting fast chunk into fastbin (at | double free or corruption (fasttop) |
_int_free | While inserting fast chunk into fastbin (at | invalid fastbin entry (free) |
_int_free | If the chunk is not within the size range of fastbin and neither it is a mmapped chunks, check whether it is not the same as the top chunk | double free or corruption (top) |
_int_free | Check whether next chunk (by memory) is within the boundaries of the arena | double free or corruption (out) |
_int_free | Check whether next chunk's (by memory) previous in use bit is marked | double free or corruption (!prev) |
_int_free | Check whether size of next chunk is within the minimum and maximum size ( | free(): invalid next size (normal) |
_int_free | While inserting the coalesced chunk into unsorted bin, check whether | free(): corrupted unsorted chunks |
*: 'P' refers to the chunk being unlinked
**: 'p' refers to the chunk being freed
Last updated