[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 28 Dec 2013 20:34:45 -0500
From: Rich Felker <dalias@...ifal.cx>
To: musl@...ts.openwall.com
Subject: Re: Re: NULL deref SEGV in malloc.c:unbin()
On Sun, Dec 29, 2013 at 01:05:15AM +0100, Szabolcs Nagy wrote:
> * Szabolcs Nagy <nsz@...t70.net> [2013-12-29 01:01:12 +0100]:
> >
> > so it seems the corruption starts before opendir
> >
> > it would be nice to see where 0x2139018 comes from and why
> > mal.binmap and mal.bin[40] aren't managed properly
>
> probably unrelated but i dont understand
>
> split = (void *)((char *)self + n);
>
> in pretrim and trim
>
> why is the n enough between the start of self and split
> chunks? (and not n + overhead)
The first line of malloc() calls adjust_size(&n). After that, n is
always in terms of total chunk size needed, not caller-usable size.
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
