[<prev] [next>] [day] [month] [year] [list]
Message-ID: <41250.141.76.45.35.1213287131.squirrel@mail.macmail.com>
Date: Thu, 12 Jun 2008 17:12:11 +0100 (BST)
From: pandora@...mail.com
To: oss-security@...ts.openwall.com
Subject: malloc and heap corruption
Hi,
(apologies if this is not appropriate content, but secproc seems dead)
I've just read up a bit on heap corruption and malloc implementations, and
found that there's at least one open source malloc (dnmalloc by Yves Younan,
http://www.fort-knox.org/) which claims to be invulnerable against
overflows and double frees (it keeps heap management data in a separate area
protected by guard pages), at performance cempetitive to glibc malloc.
However, it seems nobody has picked up on that (only a prototype, apparently
coded as part of a PhD thesis, has been released two years ago), thus I
wonder what the reason is.
Is the whole idea is somehow flawed? Can one construct heap buffer overflows
that could jump across a guard page without touching it? Would you consider
silent data corruption (dnmalloc only protects the heap management data) as
more ominous than the possibility of executing arbitrary code?
(No, I'm not the dnmalloc author, and I'm not begging for code review
either - I would just like to know whether there is some obvious reason
why it would be stupid to use it in my app instead of the glibc malloc).
Thanks.
- IB
--
MacMail - the Webmail service especially for Mac users worldwide
http://www.macmail.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
