search

shellphish / how2heap

A repository for learning various heap exploitation techniques.
MIT License
7.12k stars 1.13k forks source link

fixed sysmalloc_int_free.c MALLOC_ALIGN #184

Closed gfelber closed 4 months ago

gfelber commented 4 months ago

sry to bump this put i saw you modified sysmalloc_int_free.c https://github.com/shellphish/how2heap/commit/ae4dbf558203d72296e443e326d885b0f7994e63 https://github.com/shellphish/how2heap/commit/4ed6f1954565ed12e23aa84931ed9c36d00a3d8b

<< #define MALLOC_ALIGN 0x10L
>> #define MALLOC_ALIGN (SIZE_SZ*2)

i believe this happened because you merged the 2.23 example with the others, but this breaks the showcase for x86 (32 bit), so maybe revert theses changes if possible? in some earlier heap version glibc changed their heap alignment on x86 (32bit) to always be 0x10 (and not SIZE_SZ*2) https://elixir.bootlin.com/glibc/glibc-2.39/source/sysdeps/i386/malloc-alignment.h#L22 this wasn't true for 2.23, that's why this version was slightly different https://elixir.bootlin.com/glibc/glibc-2.23/source/malloc/malloc.c#L353

gfelber commented 4 months ago

heap alignment on x86 (32bit) seems to have been changed to 0x10 since 2.26 https://elixir.bootlin.com/glibc/glibc-2.26/source/sysdeps/i386/malloc-alignment.h#L22

Kyle-Kyle commented 4 months ago

Good to learn about that. My knowledge about 32bit heap didn't get updated and thought it was always SIZE_SZ*2. my bad. Thank you for the correction!