[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] malloc and heap corruption
From:       pandora () macmail ! com
Date:       2008-06-12 16:12:11
Message-ID: 41250.141.76.45.35.1213287131.squirrel () mail ! macmail ! com
[Download RAW message or body]

Hi,

(apologies if this is not appropriate content, but secproc seems dead)

I've just read up a bit on heap corruption and malloc implementations, and
found that there's at least one open source malloc (dnmalloc by Yves Younan,
http://www.fort-knox.org/) which claims to be invulnerable against
overflows and double frees (it keeps heap management data in a separate area
protected by guard pages), at performance cempetitive to glibc malloc.

However, it seems nobody has picked up on that (only a prototype, apparently
coded as part of a PhD thesis, has been released two years ago), thus I
wonder what the reason is.

Is the whole idea is somehow flawed? Can one construct heap buffer overflows
that could jump across a guard page without touching it? Would you consider
silent data corruption (dnmalloc only protects the heap management data) as
more ominous than the possibility of executing arbitrary code?

(No, I'm not the dnmalloc author, and I'm not begging for code review
either - I would just like to know whether there is some obvious reason
why it would be stupid to use it in my app instead of the glibc malloc).

Thanks.

- IB


-- 
MacMail - the Webmail service especially for Mac users worldwide
http://www.macmail.com
[prev in list] [next in list] [prev in thread] [next in thread]