House of Einherjar

House of Einherjar

原理

free中后向合并的操作（unlink），如果我们可以同时控制一个 chunk prev_size 与 PREV_INUSE 字段，那么我们就可以将新的 chunk 指向几乎任何位置。

free时合并的操作

static void
_int_free (mstate av, mchunkptr p, int have_lock)
{
	...
	    /* consolidate backward */
        if (!prev_inuse(p)) {
            prevsize = prev_size(p);
            size += prevsize;
            p = chunk_at_offset(p, -((long) prevsize));
            unlink(av, p, bck, fwd);
        }
	...
}

unlink

#define unlink(AV, P, BK, FD) {                                            \
    if (__builtin_expect (chunksize(P) != (next_chunk(P))->prev_size, 0))      \
      malloc_printerr (check_action, "corrupted size vs. prev_size", P, AV);  \
    FD = P->fd;								      \
    BK = P->bk;								      \
    if (__builtin_expect (FD->bk != P || BK->fd != P, 0))		      \
      malloc_printerr (check_action, "corrupted double-linked list", P, AV);  \
    else {								      \
        FD->bk = BK;							      \
        BK->fd = FD;							      \
        if (!in_smallbin_range (P->size)				      \
            && __builtin_expect (P->fd_nextsize != NULL, 0)) {		      \
	    if (__builtin_expect (P->fd_nextsize->bk_nextsize != P, 0)	      \
		|| __builtin_expect (P->bk_nextsize->fd_nextsize != P, 0))    \
	      malloc_printerr (check_action,				      \
			       "corrupted double-linked list (not small)",    \
			       P, AV);					      \
            if (FD->fd_nextsize == NULL) {				      \
                if (P->fd_nextsize == P)				      \
                  FD->fd_nextsize = FD->bk_nextsize = FD;		      \
                else {							      \
                    FD->fd_nextsize = P->fd_nextsize;			      \
                    FD->bk_nextsize = P->bk_nextsize;			      \
                    P->fd_nextsize->bk_nextsize = FD;			      \
                    P->bk_nextsize->fd_nextsize = FD;			      \
                  }							      \
              } else {							      \
                P->fd_nextsize->bk_nextsize = P->bk_nextsize;		      \
                P->bk_nextsize->fd_nextsize = P->fd_nextsize;		      \
              }								      \
          }								      \
      }									      \
}

演示程序

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
int main(){
	long long int *s0 = (long long int *)malloc(0x200);
	long long int *s1 = (long long int *)malloc(0x18);
	long long int *s2 = (long long int *)malloc(0xf0);
	long long int *s3 = (long long int *)malloc(0x20);
	s0[0] = 0;
	s0[1] = 0x81;
	s0[2] = (long long int)s0;
	s0[3] = (long long int)s0;
	s0[16] = 0x80;
	s1[2] = 0x220;
	s2[-1] = 0x100;
	free(s2);
	return 0;
}

结果s0,s1,s2合并放入unsorted bin中

free(s2)前各个堆上的伪造情况