Skip to contentSkip to conversation

malloc_heap: Possible Control Block Overwrite When Insufficient Space in Elem

DISCUSSION wuchangsheng (C) 1 participant 1 message Mar 30, 2023

lore
Share & tools
lore
#0 lore raw

Hello,

I seem to have discovered a problem in the heap memory allocation and deallocation operations.

    |------------------|----------------------------|

elem padsize newelem

In the malloc_elem_alloc function, when padsize > cache-line (such as 64 bytes) and padsize < sizeof(struct malloc_elem), the initialization of new_elem will overwrite and damage the struct malloc_elem information of elem, while setting the state of new_elem to ELEM_PAD. When releasing new_elem in malloc_elem_free, it will be converted to elem using RTE_PTR_SUB(new_elem, new_elem->pad), but at this point, the struct malloc_elem information of elem is damaged.