microsoft / microsoft/mimalloc

Question about secure mode and relationship to DieHarder

Open
#161 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
13.4k
Forks
1.2k
Avg merge
4d 45m
Merged PRs (30d)
13

Description

Hi, all.
I am currently evaluating my tool, ArcHeap: https://arxiv.org/pdf/1903.00503.pdf

I saw mimalloc has secure mode, so I am testing it with my tool.
And it seems it has the similar bug with DieHarder (https://github.com/emeryberger/DieHard).

```
#include
#include
#include
#include

void* p[256];
uintptr_t buf[256];

int main() {
p[0] = malloc(622616);
p[1] = malloc(655362);
p[2] = malloc(786432);
free(p[2]);
// [VULN] Double free
free(p[2]);
p[3] = malloc(786456);
// [BUG] Found overlap
// p[3]=0x429b2ea2000 (size=917504), p[1]=0x429b2e42000 (size=786432)
fprintf(stderr, "p1: %p-%p, p2: %p-%p\n", p[3], p[3] + 917504, p[1], p[1] + 786432);
}
// The number of actions: 16
// [INFO] EVENT_OVERLAP is detected
```

This PoC always returns overlapping chunk in my Linux machine.
Does it based on https://github.com/emeryberger/DieHard, so it has the same bug?
Or is it just collision?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the supplied C PoC in mimalloc secure mode on Linux and compare the reported allocation ranges after the double free. Read the secure-mode behavior and the DieHarder comparison in the project context. Done means determining whether the overlap is a genuine allocator vulnerability or an expected collision, with supporting evidence and a clear explanation.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.