Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 28 Dec 2013 20:34:45 -0500
From: Rich Felker <>
Subject: Re: Re: NULL deref SEGV in malloc.c:unbin()

On Sun, Dec 29, 2013 at 01:05:15AM +0100, Szabolcs Nagy wrote:
> * Szabolcs Nagy <> [2013-12-29 01:01:12 +0100]:
> > 
> > so it seems the corruption starts before opendir
> > 
> > it would be nice to see where 0x2139018 comes from and why
> > mal.binmap and mal.bin[40] aren't managed properly
> probably unrelated but i dont understand
> split = (void *)((char *)self + n);
> in pretrim and trim
> why is the n enough between the start of self and split
> chunks? (and not n + overhead)

The first line of malloc() calls adjust_size(&n). After that, n is
always in terms of total chunk size needed, not caller-usable size.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.