Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer in the table prior to freeing (returning early if it isn't present, and removing it if it is), and then LD_PRELOAD these malloc/calloc and free functions with a program like Firefox, in order to protect from double frees? Is there a reason why the standard malloc/calloc and free functions don't use such a technique, or why there isn't a secure variant that is suggested similarly to how strcpy_s is suggested in place of strcpy?

  • "LD_PRELOAD these malloc/calloc and free functions with a program like Firefox" - What does Firefox have to do with any of this? – MechMK1 May 26 '20 at 6:57
  • Always start with the assumption that there are people with way more experience who already considered any possible trivial solution. As such, it's better to ask "Why is malloc/callor not implemented in a way that prevents double free vulnerabilities?" – MechMK1 May 26 '20 at 7:03

No. The reason double free is a vulnerability is that the memory has been reallocated for something else before the second free. Any such wrapper would have no way of knowing whether the free was intended for the first or second allocation of memory at that address.

  • It's removed from the hash table if it is present during the first free. – cyborg May 26 '20 at 5:12
  • @cyborg But it will get re-added during the second malloc. – Joseph Sible-Reinstate Monica May 26 '20 at 5:12
  • if you free after the second malloc, and the second malloc happened after the first free, I don't see why it would be a double free. – cyborg May 26 '20 at 5:13
  • 1
    @cyborg Because the second free was on the old pointer, while the application is still using the memory via the new pointer. If you don't understand that, then you don't understand double frees at all. – Joseph Sible-Reinstate Monica May 26 '20 at 5:13
  • 1
    @cyborg You can't "make a void **" in a useful way, if you're only passed a void *. If you try, you'll end up with a pointer to your own local variable, instead of to the caller's copy. – Joseph Sible-Reinstate Monica May 26 '20 at 5:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.