3 ms·
I tested it on Ubuntu 14.04 x64, and the problem occurs there. And of course, some programs use replacements like dlmalloc and do all their own allocation mana
by kayamon 11y ago
I tested it on Ubuntu 14.04 x64, and the problem occurs there.
And of course, some programs use replacements like dlmalloc and do all their own allocation management anyway.
- thaumaturgy 11y ago> And of course, some programs use replacements like dlmalloc and do all their own allocation management anyway. Yeah. I wrote my own allocator in C++ a long time ago. I wouldn't be surprised if there weren't quite a few other bits of software out there doing the same thing.
- kayamon 11y agoWasn't Heartbleed due to exactly that - using their own local allocator instead of calling malloc/free?
- ikeboy 11y agoHeartbleed was due to not checking the bounds. https://www.openssl.org/news/secadv_20140407.txt https://www.openssl.org/news/secadv_20140407.txt https://xkcd.com/1354/ https://xkcd.com/1354/
- thaumaturgy 11y agoPartly. They were using their own allocator (openssl_malloc()), but even then they would've been OK if it weren't for the OBO error elsewhere in the heartbeat implementation. If they were using an OS-supplied malloc() instead of openssl_malloc(), the bug would've still been exploitable on some operating systems, but not others. Either way, "don't write your own allocator" is a good lesson to learn. Unless, of course, you're doing it for fun. In which case, efficient heap management really is a neat exercise.