Comments (11)
Because c should have the same range as a. size of a is 512. Size of c is 500. They fall in the same range in libc.
from how2heap.
There is nothing wrong with the code.
from how2heap.
@Kyle-Kyle so I got the idea wrong? On the end of execution a != c (pointers) and it's ok?
As I understand from heap-exploitation 512
bytes chunk is splitted in two 500
and probably 12
bytes (it's probably how it work on my local machine). And if c
size fall in range from 505
to 520
malloc choose a
chunk without splitting.
from how2heap.
There is no spliting at all in this case on you local machine. You know how bins works right? When you do a malloc, the size will be rounded up. So in this case, 512 will be rounded up to 520. Everything between 505 to 520 will be rounded up to 520. If the size does not fall in the range, it does not use the size at all, there is no way to return the same chunk.
from how2heap.
@Kyle-Kyle so output as below is expected? thank you for answers
This file doesn't demonstrate an attack, but shows the nature of glibc's allocator.
glibc uses a first-fit algorithm to select a free chunk.
If a chunk is free and large enough, malloc will select this chunk.
This can be exploited in a use-after-free situation.
Allocating 2 buffers. They can be large, don't have to be fastbin.
1st malloc(512): 0x557a17c7c260
2nd malloc(256): 0x557a17c7c470
we could continue mallocing here...
now let's put a string at a that we can read later "this is A!"
first allocation 0x557a17c7c260 points to this is A!
Freeing the first one...
We don't need to free anything again. As long as we allocate less than 512, it will end up at 0x557a17c7c260
So, let's allocate 500 bytes
3rd malloc(500): 0x557a17c7c580
And put a different string here, "this is C!"
3rd allocation 0x557a17c7c580 points to this is C!
first allocation 0x557a17c7c260 points to
If we reuse the first allocation, it now holds the data from the third allocation.
from how2heap.
@0x3c3e Is right, because of tcache this example does not work as expected right now.
Because 500 and 512 end up in two different tcache bins.
I'll fix it in a sec.
from how2heap.
The TCache index is calculated as:
/* When "x" is from chunksize(). */
# define csize2tidx(x) (((x) - MINSIZE + MALLOC_ALIGNMENT - 1) / MALLOC_ALIGNMENT)
/* When "x" is a user-provided size. */
# define usize2tidx(x) csize2tidx (request2size (x))
#define request2size(req) \
(((req) + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE) ? \
MINSIZE : \
((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)
/* The smallest possible chunk */
#define MIN_CHUNK_SIZE (offsetof(struct malloc_chunk, fd_nextsize))
/* The smallest size we can malloc is an aligned minimal chunk */
#define MINSIZE \
(unsigned long)(((MIN_CHUNK_SIZE+MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK))
#define MALLOC_ALIGNMENT (2 * SIZE_SZ < __alignof__ (long double) \
? __alignof__ (long double) : 2 * SIZE_SZ)
So if we request 505 we get:
req = 505
size = (505 + 8 + 0xf) & ~0xf = 528
tidx = (528 - 0x20 +0x10 - 1) / 0x10 = 31
If we request 520 we get:
req = 520
size = (520 + 8 + 0xf) & ~0xf = 528
tidx = (528 - 0x20 +0x10 - 1) / 0x10 = 31
So those are the extremes around 512 that end up in the same tcache idx
I should add this calculation to the first_fit.c example maybe...
from how2heap.
@Kyle-Kyle Before it was going in the unsorted_bin so it returned the same chunk.
In that regard the behavior changed.
We could also just make it big enough to not fall in tcache range.
from how2heap.
In fact, I'll just do that and add an example for tcache indexing.
from how2heap.
yeap. I finally get the problem. My bad. @0x3c3e you are right, this is not expected.
from how2heap.
@0x3c3e Should be fixed now, see also the calc_tcache_idx example
from how2heap.
Related Issues (20)
- wrong in unsafe_unlink.c in glibc2.31 HOT 1
- something not clearly when calculating on the size of padding in poision_null_byte.c in glibc2.31 HOT 9
- Shellphish
- tcache attacks on glibc2.27 no longer work on ubuntu 18.04 HOT 13
- House of Storm POC Randomization Issue HOT 12
- house_of_lore.c in glibc_2.31 is incorrect HOT 3
- House of Lore redundancy HOT 1
- tcache_dup.c link in readme points to 404 page HOT 2
- Add some heap information HOT 2
- House of spirit HOT 12
- House of lore HOT 3
- House of Gods HOT 25
- how2heap indexed JSON files HOT 4
- Not working on ubuntu 22.04, version `GLIBC_2.34' not found HOT 6
- New little trick in ptmalloc HOT 5
- "Complete Setup" doesn't work -> version `GLIBC_2.34' not found HOT 10
- [Feature] Link libc during compile time instead of using ./glibc_run.sh HOT 9
- fastbin_dup_consolidate wrong technique description HOT 1
- fastbin_dup_consolidate wrong explanation HOT 4
- unsafe_unlink links to old unlink_chunk function HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from how2heap.