Categories
Application Security Heap Exploitation

glibc Heap Exploitation: fastbin dup techniques

Consider what happens if we allocate a fastbin-sized chunk and freed it multiple times. We know that free() pushes the freed chunk to the fastbin, but if freed multiple times, the same freed chunk would end up multiple times in the same fastbin, which makes reallocation of the same chunk to different allocation requests possible. This is […]

Categories
Application Security OS Internals

Heaps of Fun with glibc malloc

Update 06/2018: Added thread-local caching (tcache) Introduction to glibc malloc What is the heap? If you’ve taken an operating systems class before, you might recall that it is a free-floating region of memory that is managed by a memory allocator. When using a memory allocator to allocate memory, we call it dynamic memory allocation. In […]