On Wed, Mar 18, 2020 at 03:35:45PM +0530, Neeraj Pal wrote:
> On Wed, 18 Mar, 2020, 12:46 pm Otto Moerbeek, <[email protected]> wrote:
>
> > There are several types of canaries. They try to detect corruption of
> > various meta data structures. There are alo canaries for user allocated
> > data, they are enabled with the C option.
> >
> Yeah, I am using option C through sysctl(8) to understand the Canary
> concept. And understood the user controlled part, that validates during
> free(3).
>
> But I was thinking the idea behind the writing the canary checks, I know
> canary is something means random cookie which we usually places to detect
> overflow/underflow related vulns. So, I thought if there is now way one can
> corrupt the metadata then is it possible to remove them as may be it will
> improve some performance. But I don't have the idea or main reason for the
> same. So I maybe wrong. So, that's why I asked.
Not all meta-data canaries live in r/o memory.
>
> >
> > In general addding an int to a pointer calculates an offset, so yes.
> >
> Yeah, I understood.
>
> Study whats the role of p and k is. Let the code speak. If you fail to
> > understand parts, study further and play with it. You'll learn more
> > from that than asking for confirmation all the time.
>
> Yeah sure. I understood basic idea about those calculations for p and k.
> That, p is page, here, and k is the offset for the chunk on the page. I
> think the whole calculations related to that. But due to lots of
> mathematical operations not able to understood some parts,maybe I have to
> read and understand it again and again.
>
> Actually, after compiling libc with debug symbols, I have written one basic
> sample code and debugging it though gdb and reading the source code side by
> side.
>
> I am daily learning something new from reading the malloc(3) code. But
> sometimes I am not able to relate or match those thoughts that I got from
> reading codes with the thoughts of the developer that he has while
> development. So that's why I have asked about my understanding from
> developer's point of view.
>
> Thank you for resolving my queries :)
>
> Regards
> Neeraj
A thing that also helps is to follow the cvs history of a file. The
first version of my malloc (form 2008) was more simple, and looking at
the diffs through the years gives you great hints at what features
were added over the years, plus a few bugfixes.
-Otto
