isoalloc
isoalloc copied to clipboard
Separate fixed-size allocations from the others inside zones
As suggested by @thejh, separating allocations where the compiler can prove that the allocation is fixed-size from the other allocations makes it a bit harder for attacker to exploit UAF, due to object size constrains.
This technique only makes sense when isoalloc isn't used via LD_PRELOAD
or in a separate library of course.
I spent some time trying to implement this but ultimately was not able to get clangs __builtin_constant_p
to work correctly within iso_alloc()
even when compiling sources directly. Can revisit this if you have a PoC?