search

shellphish / how2heap

A repository for learning various heap exploitation techniques.
MIT License
7.12k stars 1.13k forks source link

unsafe_unlink links to old unlink_chunk function #188

Closed k4lizen closed 4 months ago

k4lizen commented 4 months ago 
    printf("Now we free chunk1 so that consolidate backward will unlink our fake chunk, overwriting chunk0_ptr.\n");
    printf("You can find the source of the unlink macro at https://sourceware.org/git/?p=glibc.git;a=blob;f=malloc/malloc.c;h=ef04360b918bceca424482c6db03cc5ec90c3e00;hb=07c18a008c2ed8f5660adba2b778671db159a141#l1344\n\n");
    free(chunk1_ptr);

The linked macro: image Doesn't even have the prev_size check that is being considered in the code, so it would probably be a good idea to link a newer version, especially since the check is not even a marco anymore, but a function: https://elixir.bootlin.com/glibc/glibc-2.35/source/malloc/malloc.c#L1626

Kyle-Kyle commented 4 months ago

I think there are two links in the technique. The first one links to the prev_size check you mentioned in the issue. And it is there in glibc-2.35: https://elixir.bootlin.com/glibc/glibc-2.35/source/malloc/malloc.c#L4770

The unlink macro/function is the second link. Yeah, it is a function now, no longer a macro anymore. I'll fix the description.

Kyle-Kyle commented 4 months ago

the description is updated in https://github.com/shellphish/how2heap/commit/64e5089dce5bae87ec3a16c68d8e30e2f6cbf075