[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 17 Sep 2021 17:09:57 -0700
From: Keith Packard <keithp@...thp.com>
To: Alan Coopersmith <alan.coopersmith@...cle.com>,
libc-coord@...ts.openwall.com
Subject: Re: freezero() and freezeroall()
Alan Coopersmith <alan.coopersmith@...cle.com> writes:
> The reliance on the caller to provide the size to clear allows the function
> to be implemented independently of the underlying allocator library, and has
> allowed this function to be implemented in libbsd, as well as fallback
> implementations provided in portable software packages for systems without
> their own implementation - including in OpenSSH, OpenNNTPd, OpenBGPd,
> OpenIKEd, OpenSMTPd, sudo, tmux, libretls, and a few more I see in the search
> results on codesearch.debian.net. I've also seen it implemented in libc on
> illumos and DragonflyBSD.
Given C compilers knowledge of 'free' semantics, I'm concerned that
these fallbacks aren't actually doing what they think they're doing...
#include <stdlib.h>
#include <malloc.h>
#include <string.h>
void
freezero(void *ptr, size_t size)
{
memset(ptr, '\0', size);
free(ptr);
}
->
freezero:
jmp free@PLT
With that in mind, adding this to the C library seems critical to me;
that way, the application doesn't have to try to work around the
compiler.
> I'm working on adding it to the Solaris libc now, and since we can determine
> the underlying allocation size, proposed also adding:
>
> void freezeroall(void *ptr);
>
> as basically doing: freezero(ptr, malloc_usable_size(ptr));
I'd suggest that your freezeroall call should be the only public
function; we don't require that applications pass back the current size
when calling realloc, after all. A fallback implementation could use
malloc_usable_size, after all.
> During review of this change I was asked if there's any existing equivalent
> we should be following instead before we invent our own name - I couldn't
> find one, but figured I'd ask here - are other libc implementations doing
> anything like this?
I'm clearing memory at malloc time to avoid inconsistent application
behavior when they fail to initialize memory; this also seems like a
useful thing for security though. It's expensive from a caching
perspective as memory being free is not necessarily hot in the
cache. Malloc time seems like less of an issue as presumably the
application is about to fill the allocated memory with content.
--
-keith
Download attachment "signature.asc" of type "application/pgp-signature" (833 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
