Heap Memory

heap-exploitation
Search…
heap-exploitation
Preface
Author
Introduction
Heap Memory
Diving into glibc heap
Heap Exploitation
Secure Coding Guidelines
Heap Memory
What is Heap?
Heap is a memory region allotted to every program. Unlike stack, heap memory can be dynamically allocated. This means that the program can 'request' and 'release' memory from the heap segment whenever it requires. Also, this memory is global, i.e. it can be accessed and modified from anywhere within a program and is not localized to the function where it is allocated. This is accomplished using 'pointers' to reference dynamically allocated memory which in turn leads to a small degradation in performance as compared to using local variables (on the stack).
Using dynamic memory
stdlib.h provides with standard library functions to access, modify and manage dynamic memory. Commonly used functions include malloc and free:
1
// Dynamically allocate 10 bytes
2
char *buffer = (char *)malloc(10);
3
​
4
strcpy(buffer, "hello");
5
printf("%s\n", buffer); // prints "hello"
6
​
7
// Frees/unallocates the dynamic memory allocated earlier
8
free(buffer);
Copied!
The documentation about 'malloc' and 'free' says:
malloc:
1
/*
2
  malloc(size_t n)
3
  Returns a pointer to a newly allocated chunk of at least n
4
  bytes, or null if no space is available. Additionally, on 
5
  failure, errno is set to ENOMEM on ANSI C systems.
6
​
7
  If n is zero, malloc returns a minimum-sized chunk. (The
8
  minimum size is 16 bytes on most 32bit systems, and 24 or 32
9
  bytes on 64bit systems.)  On most systems, size_t is an unsigned
10
  type, so calls with negative arguments are interpreted as
11
  requests for huge amounts of space, which will often fail. The
12
  maximum supported value of n differs across systems, but is in
13
  all cases less than the maximum representable value of a
14
  size_t.
15
*/
Copied!
free:
1
/*
2
  free(void* p)
3
  Releases the chunk of memory pointed to by p, that had been
4
  previously allocated using malloc or a related routine such as
5
  realloc. It has no effect if p is null. It can have arbitrary
6
  (i.e., bad!) effects if p has already been freed.
7
​
8
  Unless disabled (using mallopt), freeing very large spaces will
9
  when possible, automatically trigger operations that give
10
  back unused memory to the system, thus reducing program
11
  footprint.
12
*/
Copied!
It is important to note that these memory allocation functions are provided by the standard library. These functions provide a layer between the developer and the operating system that efficiently manages heap memory. It is the responsibility of the developer to 'free' any allocated memory after using it exactly once. Internally, these functions use two system calls sbrk and mmap to request and release heap memory from the operating system. This post discusses these system calls in detail.
Introduction
Diving into glibc heap
Last modified 1yr ago
Copy link
Contents
What is Heap?
Using dynamic memory