Question

Can anyone give out some example code which will make malloc signal an sigsegv？
Googled that, heap corruption may lead to an sigsegv in malloc, but I can’t understand that.

Thanks a lot.

Answer 1

There’s a decent chance this will cause problems, though it might be free() rather than malloc() that gives you the SIGSEGV.

 void *vp = malloc(1024);
 memset((char *)vp - 32, 0, 1024);
 free(vp);

You might get the crash in malloc() with:

 enum { SZ_ALLOC = 1024, SZ_PREFIX = 32, SZ_SUFFIX = 32, SET_BYTE = '\0' };

 void *v1 = malloc(SZ_ALLOC);
 free(v1);
 memset((char *)v1 - SZ_PREFIX, SET_BYTE, SZ_ALLOC + SZ_PREFIX + SZ_SUFFIX);
 void *v2 = malloc(SZ_ALLOC);

This overwrites 32 bytes before and after the allocated memory, which is likely to corrupt any control information if it is stored contiguously will the allocated memory (which is usually the case). Using zeroes maximizes the chance that you’ll get a null pointer access. You could choose an alternative value to write over the data which might means that sizes appear larger than zero (where zero sizes might protect you from memory access).

Of course, this is all completely undefined behaviour; you might get the crash in memset(), or you might not get a crash at all.