Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 12 Jun 2008 17:12:11 +0100 (BST)
Subject: malloc and heap corruption


(apologies if this is not appropriate content, but secproc seems dead)

I've just read up a bit on heap corruption and malloc implementations, and
found that there's at least one open source malloc (dnmalloc by Yves Younan, which claims to be invulnerable against
overflows and double frees (it keeps heap management data in a separate area
protected by guard pages), at performance cempetitive to glibc malloc.

However, it seems nobody has picked up on that (only a prototype, apparently
coded as part of a PhD thesis, has been released two years ago), thus I
wonder what the reason is.

Is the whole idea is somehow flawed? Can one construct heap buffer overflows
that could jump across a guard page without touching it? Would you consider
silent data corruption (dnmalloc only protects the heap management data) as
more ominous than the possibility of executing arbitrary code?

(No, I'm not the dnmalloc author, and I'm not begging for code review
either - I would just like to know whether there is some obvious reason
why it would be stupid to use it in my app instead of the glibc malloc).


- IB

MacMail - the Webmail service especially for Mac users worldwide

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.