unlink
Code
Graphical Explanation
Check this great graphical explanation of the unlink process:
Security Checks
Check if the indicated size of the chunk is the same as the prev_size indicated in the next chunk
Check also that
P->fd->bk == P
andP->bk->fw == P
If the chunk is not small, check that
P->fd_nextsize->bk_nextsize == P
andP->bk_nextsize->fd_nextsize == P
Leaks
An unlinked chunk is not cleaning the allocated addresses, so having access to rad it, it's possible to leak some interesting addresses:
Libc Leaks:
If P is located in the head of the doubly linked list,
bk
will be pointing tomalloc_state
in libcIf P is located at the end of the doubly linked list,
fd
will be pointing tomalloc_state
in libcWhen the doubly linked list contains only one free chunk, P is in the doubly linked list, and both
fd
andbk
can leak the address insidemalloc_state
.
Heap leaks:
If P is located in the head of the doubly linked list,
fd
will be pointing to an available chunk in the heapIf P is located at the end of the doubly linked list,
bk
will be pointing to an available chunk in the heapIf P is in the doubly linked list, both
fd
andbk
will be pointing to an available chunk in the heap
Last updated