Skip to content

Commit 81223bd

Browse files
committed
fix: remove unnecessary size equality check bypass
The `P->bk->size == P->prev_size` check in unlink() was introduced in GLIBC 2.26 and does not exist in the implementations of GLIBC 2.23 or 2.24. Therefore, fake_chunk[0] and fake_chunk[1] do not need to be equal in these versions. The original note explicitly stated that they should be equal, which could be misleading in many situations.
1 parent 9cdc4e0 commit 81223bd

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

glibc_2.23/house_of_einherjar.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ int main()
3838

3939
size_t fake_chunk[6];
4040

41-
fake_chunk[0] = 0x100; // prev_size is now used and must equal fake_chunk's size to pass P->bk->size == P->prev_size
41+
fake_chunk[0] = 0x00; // The prev_size vs. size check is of no concern, until GLIBC 2.26 P->bk->size == P->prev_size check
4242
fake_chunk[1] = 0x100; // size of the chunk just needs to be small enough to stay in the small bin
4343
fake_chunk[2] = (size_t) fake_chunk; // fwd
4444
fake_chunk[3] = (size_t) fake_chunk; // bck

glibc_2.24/house_of_einherjar.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ int main()
3838

3939
size_t fake_chunk[6];
4040

41-
fake_chunk[0] = 0x100; // prev_size is now used and must equal fake_chunk's size to pass P->bk->size == P->prev_size
41+
fake_chunk[0] = 0x00; // The prev_size vs. size check is of no concern, until GLIBC 2.26 P->bk->size == P->prev_size check
4242
fake_chunk[1] = 0x100; // size of the chunk just needs to be small enough to stay in the small bin
4343
fake_chunk[2] = (size_t) fake_chunk; // fwd
4444
fake_chunk[3] = (size_t) fake_chunk; // bck

0 commit comments

Comments
 (0)