On Dec 02, 2003, at 06:03, Stefan Esser wrote:
Nice advertisement but you should underline the fact, that it only protects against glibc malloc()/free() problems. There are a number of software packages that implement their own heap wrappers or work with linked lists. They still are vulnerable to heap overflows. f.e. PHP.
This is correct, and we state as much in our LISA paper. Apologies for not emphasizing it more in my post yesterday; I'll make sure the project page makes this clearer.
And on the other hand there is a much simpler way to protect any unlink from a linked list from ever beeing exploited.
This is true in the case of the fd and bk pointers, and in fact this is one of the checks that dlmalloc's debugging code performs. However, as we also demonstrated in the paper, you are still open to other heap-related attacks, such as overwriting size fields and setting up fake chunk headers. So, unfortunately I don't think that check alone is sufficient.
Stefan Esser
-- William Robertson Reliable Software Group, UC Santa Barbara http://www.cs.ucsb.edu/~wkr/
