Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(6)

Issue 10944024: Mask freelist entries in tcmalloc (Closed)

Created:
8 years, 3 months ago by jschuh
Modified:
8 years, 3 months ago
CC:
chromium-reviews, dmikurube+memory_chromium.org
Visibility:
Public.

Description

Mask freelist entries in tcmalloc The goal here is to prevent freelist spraying in exploits, and as a bonus to make UAF fail a bit more early and obviously. Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=157857

Patch Set 1 : #

Patch Set 2 : #

Patch Set 3 : #

Total comments: 3

Patch Set 4 : #

Unified diffs Side-by-side diffs Delta from patch set Stats (+19 lines, -4 lines) Patch
M third_party/tcmalloc/chromium/src/free_list.cc View 1 2 3 3 chunks +19 lines, -4 lines 0 comments Download

Messages

Total messages: 7 (0 generated)
jschuh
8 years, 3 months ago (2012-09-19 22:48:44 UTC) #1
jar (doing other things)
http://codereview.chromium.org/10944024/diff/1003/third_party/tcmalloc/chromium/src/free_list.cc File third_party/tcmalloc/chromium/src/free_list.cc (right): http://codereview.chromium.org/10944024/diff/1003/third_party/tcmalloc/chromium/src/free_list.cc#newcode87 third_party/tcmalloc/chromium/src/free_list.cc:87: const uintptr_t mask = static_cast<intptr_t>(!p) - 1; Why play ...
8 years, 3 months ago (2012-09-20 17:13:57 UTC) #2
jschuh
http://codereview.chromium.org/10944024/diff/1003/third_party/tcmalloc/chromium/src/free_list.cc File third_party/tcmalloc/chromium/src/free_list.cc (right): http://codereview.chromium.org/10944024/diff/1003/third_party/tcmalloc/chromium/src/free_list.cc#newcode87 third_party/tcmalloc/chromium/src/free_list.cc:87: const uintptr_t mask = static_cast<intptr_t>(!p) - 1; On 2012/09/20 ...
8 years, 3 months ago (2012-09-20 17:26:13 UTC) #3
jar (doing other things)
lgtm http://codereview.chromium.org/10944024/diff/1003/third_party/tcmalloc/chromium/src/free_list.cc File third_party/tcmalloc/chromium/src/free_list.cc (right): http://codereview.chromium.org/10944024/diff/1003/third_party/tcmalloc/chromium/src/free_list.cc#newcode87 third_party/tcmalloc/chromium/src/free_list.cc:87: const uintptr_t mask = static_cast<intptr_t>(!p) - 1; On ...
8 years, 3 months ago (2012-09-20 17:33:30 UTC) #4
jschuh
On 2012/09/20 17:33:30, jar wrote: > lgtm > > http://codereview.chromium.org/10944024/diff/1003/third_party/tcmalloc/chromium/src/free_list.cc > File third_party/tcmalloc/chromium/src/free_list.cc (right): > ...
8 years, 3 months ago (2012-09-20 18:15:24 UTC) #5
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-status.appspot.com/cq/jschuh@chromium.org/10944024/15002
8 years, 3 months ago (2012-09-20 19:05:22 UTC) #6
commit-bot: I haz the power
8 years, 3 months ago (2012-09-20 22:34:24 UTC) #7
Change committed as 157857

Powered by Google App Engine
This is Rietveld 408576698