3 ms·
> The aggressive free() also exposed use-after-free bugs never before seen What do you mean by that? Is there an overview somewhere about "aggressive free()" t
by yakubin 5y ago
> The aggressive free() also exposed use-after-free bugs never before seen
What do you mean by that? Is there an overview somewhere about "aggressive free()" that I can read?
- chasil 5y agoI'll look it up for you a little later. OpenBSD altered malloc/free to use mmap instead of sbrk. This allowed free to remove larger allocations from the address space, which caught a lot of programs that were using memory after free.
- chasil 5y agoIt looks like the conversion from sbrk to mmap happened in 2009. https://www.openbsd.org/papers/eurobsdcon2009/otto-malloc.pdf https://www.openbsd.org/papers/eurobsdcon2009/otto-malloc.pd... https://undeadly.org/cgi?action=article;sid=20090106070242 https://undeadly.org/cgi?action=article;sid=20090106070242 https://news.ycombinator.com/item?id=3286254 https://news.ycombinator.com/item?id=3286254 https://web.archive.org/web/20111231094521/http://os-blog.com/how-openbsd-leverages-malloc-to-find-bugs/ https://web.archive.org/web/20111231094521/http://os-blog.co... General architecture: https://utcc.utoronto.ca/~cks/space/blog/unix/SbrkVersusMmap https://utcc.utoronto.ca/~cks/space/blog/unix/SbrkVersusMmap
- yakubin 5y agoThanks for the links.