RPISEC / MBE

Course materials for Modern Binary Exploitation by RPISEC
BSD 2-Clause "Simplified" License
5.47k stars 883 forks source link

Error in Lecture 10 Slide 16 #23

Closed sciencemanx closed 5 years ago

sciencemanx commented 8 years ago

malloc(20) should take 32 bytes not 24 (24 to be 8 byte aligned and 8 for the metadata).

0xTowel commented 5 years ago

The slides are correct.

The system is 32bit, so an address takes 4 bytes, which is enough to store the chunk size (metadata).

An in-use chunk stores the chunk size, while a free chunk stores the prev_chunk size at the end of the chunk, written upon free(). This means when you malloc(20), you only need 24 bytes which is already aligned to a multiple of 8. See the in-use chunk diagram here.

Note that you don't need any more space for the flags since they are the 3 least-significant bits of the chunk size, which don't matter since everything is aligned to 8 (0b1000) making them always be zero.

@Lense this can be closed.

Lense commented 5 years ago

Thanks!