free
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Free Order Summary
(No checks are explained in this summary and some case have been omitted for brevity)
If the address is null don't do anything
If the chunk was mmaped, mummap it and finish
Call
_int_free
:If possible, add the chunk to the tcache
If possible, add the chunk to the fast bin
Call
_int_free_merge_chunk
to consolidate the chunk is needed and add it to the unsorted list
__libc_free
Free
calls __libc_free
.
If the address passed is Null (0) don't do anything.
Check pointer tag
If the chunk is
mmaped
,mummap
it and that allIf not, add the color and call
_int_free
over it
_int_free
_int_free start
It starts with some checks making sure:
the pointer is aligned, or trigger error
free(): invalid pointer
the size isn't less than the minimum and that the size is also aligned or trigger error:
free(): invalid size
_int_free tcache
It'll first try to allocate this chunk in the related tcache. However, some checks are performed previously. It'll loop through all the chunks of the tcache in the same index as the freed chunk and:
If there are more entries than
mp_.tcache_count
:free(): too many chunks detected in tcache
If the entry is not aligned: free():
unaligned chunk detected in tcache 2
if the freed chunk was already freed and is present as chunk in the tcache:
free(): double free detected in tcache 2
If all goes well, the chunk is added to the tcache and the functions returns.
_int_free fast bin
Start by checking that the size is suitable for fast bin and check if it's possible to set it close to the top chunk.
Then, add the freed chunk at the top of the fast bin while performing some checks:
If the size of the chunk is invalid (too big or small) trigger:
free(): invalid next size (fast)
If the added chunk was already the top of the fast bin:
double free or corruption (fasttop)
If the size of the chunk at the top has a different size of the chunk we are adding:
invalid fastbin entry (free)
_int_free finale
If the chunk wasn't allocated yet on any bin, call _int_free_merge_chunk
_int_free_merge_chunk
This function will try to merge chunk P of SIZE bytes with its neighbours. Put the resulting chunk on the unsorted bin list.
Some checks are performed:
If the chunk is the top chunk:
double free or corruption (top)
If the next chunk is outside of the boundaries of the arena:
double free or corruption (out)
If the chunk is not marked as used (in the
prev_inuse
from the following chunk):double free or corruption (!prev)
If the next chunk has a too little size or too big:
free(): invalid next size (normal)
if the previous chunk is not in use, it will try to consolidate. But, if the prev_size differs from the size indicated in the previous chunk:
corrupted size vs. prev_size while consolidating
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated