Heap Functions Security Checks - HackTricks

# Heap Functions Security Checks

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

## unlink

For more info check:

unlink

This is a summary of the performed checks:

- Check if the indicated size of the chunk is the same as the `prev_size` indicated in the next chunk
  - Error message: `corrupted size vs. prev_size`
- Check also that `P->fd->bk == P` and `P->bk->fw == P`
  - Error message: `corrupted double-linked list`
- If the chunk is not small, check that `P->fd_nextsize->bk_nextsize == P` and `P->bk_nextsize->fd_nextsize == P`
  - Error message: `corrupted double-linked list (not small)`

## _int_malloc

For more info check:

malloc & sysmalloc

- Checks during fast bin search:
  - If the chunk is misaligned:
    - Error message: `malloc(): unaligned fastbin chunk detected 2`
  - If the forward chunk is misaligned:
    - Error message: `malloc(): unaligned fastbin chunk detected`
  - If the returned chunk has a size that isn't correct because of it's index in the fast bin:
    - Error message: `malloc(): memory corruption (fast)`
  - If any chunk used to fill the tcache is misaligned:
    - Error message: `malloc(): unaligned fastbin chunk detected 3`
- Checks during small bin search:
  - If `victim->bk->fd != victim`:
    - Error message: `malloc(): smallbin double linked list corrupted`
- Checks during consolidate performed for each fast bin chunk:
  - If the chunk is unaligned trigger:
    - Error message: `malloc_consolidate(): unaligned fastbin chunk detected`
  - If the chunk has a different size that the one it should because of the index it's in:
    - Error message: `malloc_consolidate(): invalid chunk size`
  - If the previous chunk is not in use and the previous chunk has a size different of the one indicated by prev_chunk:
    - Error message: `corrupted size vs. prev_size in fastbins`
- Checks during unsorted bin search:
  - If the chunk size is weird (too small or too big):
    - Error message: `malloc(): invalid size (unsorted)`
  - If the next chunk size is weird (too small or too big):
    - Error message: `malloc(): invalid next size (unsorted)`
  - If the previous size indicated by the next chunk differs from the size of the chunk:
    - Error message: `malloc(): mismatching next->prev_size (unsorted)`
  - If not `victim->bck->fd == victim` or not `victim->fd == av (arena)`:
    - Error message: `malloc(): unsorted double linked list corrupted`
    - As we are always checking the las one, it's fd should be pointing always to the arena struct.
  - If the next chunk isn't indicating that the previous is in use:
    - Error message: `malloc(): invalid next->prev_inuse (unsorted)`
  - If `fwd->bk_nextsize->fd_nextsize != fwd`:
    - Error message: `malloc(): largebin double linked list corrupted (nextsize)`
  - If `fwd->bk->fd != fwd`:
    - Error message: `malloc(): largebin double linked list corrupted (bk)`
- Checks during large bin (by index) search:
  - `bck->fd-> bk != bck`:
    - Error message: `malloc(): corrupted unsorted chunks`
- Checks during large bin (next bigger) search:
  - `bck->fd-> bk != bck`:
    - Error message: `malloc(): corrupted unsorted chunks2`
- Checks during Top chunk use:
  - `chunksize(av->top) > av->system_mem`:
    - Error message: `malloc(): corrupted top size`

## `tcache_get_n`

- Checks in `tcache_get_n`:
  - If chunk is misaligned:
    - Error message: `malloc(): unaligned tcache chunk detected`

## `tcache_thread_shutdown`

- Checks in `tcache_thread_shutdown`:
  - If chunk is misaligned:
    - Error message: `tcache_thread_shutdown(): unaligned tcache chunk detected`

## `__libc_realloc`

- Checks in `__libc_realloc`:
  - If old pointer is misaligned or the size was incorrect:
    - Error message: `realloc(): invalid pointer`

## `_int_free`

For more info check:

free

- Checks during the start of `_int_free`:
  - Pointer is aligned:
    - Error message: `free(): invalid pointer`
  - Size larger than `MINSIZE` and size also aligned:
    - Error message: `free(): invalid size`
- Checks in `_int_free` tcache:
  - If there are more entries than `mp_.tcache_count`:
    - Error message: `free(): too many chunks detected in tcache`
  - If the entry is not aligned:
    - Error message: `free(): unaligned chunk detected in tcache 2`
  - If the freed chunk was already freed and is present as chunk in the tcache:
    - Error message: `free(): double free detected in tcache 2`
- Checks in `_int_free` fast bin:
  - If the size of the chunk is invalid (too big or small) trigger:
    - Error message: `free(): invalid next size (fast)`
  - If the added chunk was already the top of the fast bin:
    - Error message: `double free or corruption (fasttop)`
  - If the size of the chunk at the top has a different size of the chunk we are adding:
    - Error message: `invalid fastbin entry (free)`

## `_int_free_merge_chunk`

- Checks in `_int_free_merge_chunk`:
  - If the chunk is the top chunk:
    - Error message: `double free or corruption (top)`
  - If the next chunk is outside of the boundaries of the arena:
    - Error message: `double free or corruption (out)`
  - If the chunk is not marked as used (in the prev_inuse from the following chunk):
    - Error message: `double free or corruption (!prev)`
  - If the next chunk has a too little size or too big:
    - Error message: `free(): invalid next size (normal)`
  - If the previous chunk is not in use, it will try to consolidate. But, if the `prev_size` differs from the size indicated in the previous chunk:
    - Error message: `corrupted size vs. prev_size while consolidating`

## `_int_free_create_chunk`

- Checks in `_int_free_create_chunk`:
  - Adding a chunk into the unsorted bin, check if `unsorted_chunks(av)->fd->bk == unsorted_chunks(av)`:
    - Error message: `free(): corrupted unsorted chunks`

## `do_check_malloc_state`

- Checks in `do_check_malloc_state`:
  - If misaligned fast bin chunk:
    - Error message: `do_check_malloc_state(): unaligned fastbin chunk detected`

## `malloc_consolidate`

- Checks in `malloc_consolidate`:
  - If misaligned fast bin chunk:
    - Error message: `malloc_consolidate(): unaligned fastbin chunk detected`
  - If incorrect fast bin chunk size:
    - Error message: `malloc_consolidate(): invalid chunk size`

## `_int_realloc`

- Checks in `_int_realloc`:
  - Size is too big or too small:
    - Error message: `realloc(): invalid old size`
  - Size of the next chunk is too big or too small:
    - Error message: `realloc(): invalid next size`

> [!TIP] Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
> Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

> Support HackTricks
> - Check the subscription plans!
> - Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
> - Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.