Date: Thu, 12 Jun 2008 17:12:11 +0100 (BST) From: pandora@...mail.com To: oss-security@...ts.openwall.com Subject: malloc and heap corruption Hi, (apologies if this is not appropriate content, but secproc seems dead) I've just read up a bit on heap corruption and malloc implementations, and found that there's at least one open source malloc (dnmalloc by Yves Younan, http://www.fort-knox.org/) which claims to be invulnerable against overflows and double frees (it keeps heap management data in a separate area protected by guard pages), at performance cempetitive to glibc malloc. However, it seems nobody has picked up on that (only a prototype, apparently coded as part of a PhD thesis, has been released two years ago), thus I wonder what the reason is. Is the whole idea is somehow flawed? Can one construct heap buffer overflows that could jump across a guard page without touching it? Would you consider silent data corruption (dnmalloc only protects the heap management data) as more ominous than the possibility of executing arbitrary code? (No, I'm not the dnmalloc author, and I'm not begging for code review either - I would just like to know whether there is some obvious reason why it would be stupid to use it in my app instead of the glibc malloc). Thanks. - IB -- MacMail - the Webmail service especially for Mac users worldwide http://www.macmail.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.