zardus / preeny

Some helpful preload libraries for pwning stuff.
BSD 2-Clause "Simplified" License
1.57k stars 170 forks source link

mallocwatch breaks on a c++ program #59

Closed sudhackar closed 5 years ago

sudhackar commented 5 years ago

If malloc is called in libstdc++ while loading before preeny_mallocwatch_orig has been called from call_init.part it crashes as such

Program received signal SIGSEGV (fault address 0x0)
pwndbg> bt
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff77d0ea6 in malloc (size=72704) at /tmp/preeny/src/mallocwatch.c:30
#2  0x00007ffff72d59c0 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#3  0x00007ffff7de879a in call_init (l=<optimized out>, argc=argc@entry=1, argv=argv@entry=0x7fffffffdff8, env=env@entry=0x7fffffffe008) at dl-init.c:72
#4  0x00007ffff7de88ab in call_init (env=0x7fffffffe008, argv=0x7fffffffdff8, argc=1, l=<optimized out>) at dl-init.c:30
#5  _dl_init (main_map=0x7ffff7ffe170, argc=1, argv=0x7fffffffdff8, env=0x7fffffffe008) at dl-init.c:120
#6  0x00007ffff7dd9c5a in _dl_start_user () from /lib64/ld-linux-x86-64.so.2
#7  0x0000000000000001 in ?? ()
#8  0x00007fffffffe33d in ?? ()
#9  0x0000000000000000 in ?? ()

Fix should be pretty simple, checking if original_mallocand family is actually set or not and then calling preeny_mallocwatch_orig https://github.com/zardus/preeny/blob/36b18745cc5b5f3284e9c7875248450070ed0c55/src/mallocwatch.c#L30

I'll send a PR.