isoalloc icon indicating copy to clipboard operation
isoalloc copied to clipboard

Separate fixed-size allocations from the others inside zones

Open jvoisin opened this issue 2 years ago • 1 comments

As suggested by @thejh, separating allocations where the compiler can prove that the allocation is fixed-size from the other allocations makes it a bit harder for attacker to exploit UAF, due to object size constrains.

This technique only makes sense when isoalloc isn't used via LD_PRELOAD or in a separate library of course.

jvoisin avatar Aug 17 '22 13:08 jvoisin

I spent some time trying to implement this but ultimately was not able to get clangs __builtin_constant_p to work correctly within iso_alloc() even when compiling sources directly. Can revisit this if you have a PoC?

struct avatar Dec 16 '23 01:12 struct