Security Checks

This presents a summary of the security checks introduced in glibc's implementation to detect and prevent heap related attacks.

Function	Security Check	Error
unlink	Whether chunk size is equal to the previous size set in the next chunk (in memory)	corrupted size vs. prev_size
unlink	Whether P->fd->bk == P and P->bk->fd == P*	corrupted double-linked list
_int_malloc	While removing the first chunk from fastbin (to service a malloc request), check whether the size of the chunk falls in fast chunk size range	malloc(): memory corruption (fast)
_int_malloc	While removing the last chunk (victim) from a smallbin (to service a malloc request), check whether victim->bk->fd and victim are equal	malloc(): smallbin double linked list corrupted
_int_malloc	While iterating in unsorted bin, check whether size of current chunk is within minimum (2*SIZE_SZ) and maximum (av->system_mem) range	malloc(): memory corruption
_int_malloc	While inserting last remainder chunk into unsorted bin (after splitting a large chunk), check whether unsorted_chunks(av)->fd->bk == unsorted_chunks(av)	malloc(): corrupted unsorted chunks
_int_malloc	While inserting last remainder chunk into unsorted bin (after splitting a fast or a small chunk), check whether unsorted_chunks(av)->fd->bk == unsorted_chunks(av)	malloc(): corrupted unsorted chunks 2
_int_free	Check whether p** is before p + chunksize(p) in the memory (to avoid wrapping)	free(): invalid pointer
_int_free	Check whether the chunk is at least of size MINSIZE or a multiple of MALLOC_ALIGNMENT	free(): invalid size
_int_free	For a chunk with size in fastbin range, check if next chunk's size is between minimum and maximum size (av->system_mem)	free(): invalid next size (fast)
_int_free	While inserting fast chunk into fastbin (at HEAD), check whether the chunk already at HEAD is not the same	double free or corruption (fasttop)
_int_free	While inserting fast chunk into fastbin (at HEAD), check whether size of the chunk at HEAD is same as the chunk to be inserted	invalid fastbin entry (free)
_int_free	If the chunk is not within the size range of fastbin and neither it is a mmapped chunks, check whether it is not the same as the top chunk	double free or corruption (top)
_int_free	Check whether next chunk (by memory) is within the boundaries of the arena	double free or corruption (out)
_int_free	Check whether next chunk's (by memory) previous in use bit is marked	double free or corruption (!prev)
_int_free	Check whether size of next chunk is within the minimum and maximum size (av->system_mem)	free(): invalid next size (normal)
_int_free	While inserting the coalesced chunk into unsorted bin, check whether unsorted_chunks(av)->fd->bk == unsorted_chunks(av)	free(): corrupted unsorted chunks

*: 'P' refers to the chunk being unlinked

**: 'p' refers to the chunk being freed