/* * K-sPecial's vulnerable program */ #include <stdio.h>#include <stdlib.h> int main (void) {   char *ptr  = malloc(1024);        /* First allocated chunk */   char *ptr2;                       /* Second chunk          */   /* ptr & ~(HEAP_MAX_SIZE-1) = 0x08000000 */   int heap = (int)ptr & 0xFFF00000;   _Bool found = 0;    printf("ptr found at %p\n", ptr);  /* Print address of first chunk */    // i == 2 because this is my second chunk to allocate   for (int i = 2; i < 1024; i++) {     /* Allocate chunks up to 0x08100000 */     if (!found && (((int)(ptr2 = malloc(1024)) & 0xFFF00000) == \                                           (heap + 0x100000))) {       printf("good heap allignment found on malloc() %i (%p)\n", i, ptr2);          found = 1; /* Go out */          break;       }    }        malloc(1024); /* Request another chunk: (ptr2 != av->top) */        /* Incorrect input: 1048576 bytes */        fread (ptr, 1024 * 1024, 1, stdin);         free(ptr);   /* Free first chunk  */        free(ptr2);  /* The House of Mind */        return(0);   /* Bye */}

#define heap_for_ptr(ptr) \((heap_info *)((unsigned long)(ptr) & ~(HEAP_MAX_SIZE-1)))#define arena_for_chunk(ptr) \(chunk_non_main_arena(ptr) ? heap_for_ptr(ptr)->ar_ptr : &main_arena)

struct malloc_state {/* Serialize access.  */mutex_t mutex;// Should we have padding to move the mutex to its own cache line?#if THREAD_STATS/* Statistics for locking.  Only used if THREAD_STATS is defined.  */long stat_lock_direct, stat_lock_loop, stat_lock_wait;#endif/* The maximum chunk size to be eligible for fastbin */INTERNAL_SIZE_T  max_fast;   /* low 2 bits used as flags *//* Fastbins */mfastbinptr      fastbins[NFASTBINS];/* Base of the topmost chunk -- not otherwise kept in a bin */mchunkptr        top;/* The remainder from the most recent split of a small request */mchunkptr        last_remainder;/* Normal bins packed as described above */mchunkptr        bins[NBINS * 2];/* Bitmap of bins */unsigned int     binmap[BINMAPSIZE];/* Linked list */struct malloc_state *next;/* Memory allocated from the system in this arena.  */INTERNAL_SIZE_T system_mem;INTERNAL_SIZE_T max_system_mem;};

  } elseclear_inuse_bit_at_offset(nextchunk, 0);   /*Place the chunk in unsorted chunk list. Chunks arenot placed into regular bins until after they havebeen given one chance to be used in malloc.  */   bck = unsorted_chunks(av);  // 返回：&fake_arena->bins[0]  fwd = bck->fd;  // fd位于malloc_chunk结构体8字节偏移处                  // 所以fwd = bck->fd = fake_arena->bins[2] = DTORS_END-12  p->bk = bck;  p->fd = fwd;  bck->fd = p;    // fake_arena->bins[2] = p  fwd->bk = p;    // bk位于malloc_chunk结构体12字节偏移处                  // 所以这里会将p，写到DTORS_END指向的内存单元，即：got[.dtors] = p   set_head(p, size | PREV_INUSE);  set_foot(p, size);   check_free_chunk(av, p);}

/** p > -size， 即：p > 0-size，即：p+size > 0，在p、size都大于0的前提下，表示p+size溢出了，但是由于p和size都是无符号数，p+size >= 0恒成立，所以写成p > -size* 个人感觉更严谨应该是：p >= -size，因为p+size == 0，也表示溢出了（比如size=0x00000001，则p=-size=0xffffffff（取反+1）时，p+size==0也为溢出）*/if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)    || __builtin_expect ((uintptr_t) p & MALLOC_ALIGN_MASK, 0))

if ((unsigned long)(size) <= (unsigned long)(av->max_fast)#if TRIM_FASTBINS    /*  If TRIM_FASTBINS set, don't place chunks  bordering top into fastbins    */    && (chunk_at_offset(p, size) != av->top)#endif    )

else if (!chunk_is_mmapped(p))

if (__builtin_expect (p == av->top, 0))

if (__builtin_expect (contiguous (av)          && (char *) nextchunk          >= ((char *) av->top + chunksize(av->top)), 0))

if (__builtin_expect (!prev_inuse(nextchunk), 0))

if (__builtin_expect (nextchunk->size <= 2 * SIZE_SZ, 0)|| __builtin_expect (nextsize >= av->system_mem, 0))

if (!prev_inuse(p))

if (nextchunk != av->top)

if (!nextinuse)

# 往期推荐

1.CVE-2012-1889 暴雷漏洞分析与利用小记

2.人工智能竞赛-目标识别指导

3.Android加壳脱壳学习—动态加载和类加载机制详解

4.某APP sig3 48位算法逆向分析

5.CVE-2021-26411漏洞分析笔记

6.Windows本地提权漏洞CVE-2014-1767分析及EXP编写指导