Memory allocation errors treatment in Arch.

daf666 · 2009-06-13 20:38:53

Arch seems to be very forgiving about invalid free()'s like:
char *lala; free(lala);

And buffer overflows like:
char lala[2]; sprintf(lala, "bababa");.

It happened several times already, that programs I wrote ran smoothly on Arch (supposedly) but then crashed miserably in Ubunto and Fedora because of a memory allocation related bug.
Is there some kernel option in the default Arch kernel that makes this happen? are the Ubuntu/Fedora kernels compiled with more strict memory allocation check settings?

vkumar · 2009-06-13 23:12:28

check this out for now;
http://wiki.archlinux.org/index.php/Grsecurity_patchset

I'm not sure if it's what you want, but it might stop you from running code like that.

wonder · 2009-06-13 23:29:25

maybe ubuntu have ssp and pie support in gblic and gcc.

ssp =stack smashing protector
pie = position independent executables
usually that is only for hardened systems.

djgera · 2009-06-13 23:40:59

what is "lala" an extern or auto variable?

daf666 · 2009-06-15 17:17:40

Thanks all for the replies.

Unfortunately its not the case, I am pretty sure it has something to do with the kernel, I guess I can just try to use the Fedora kernel inside Arch as a test.

scio · 2009-06-15 18:00:34

Wouldn't free and malloc differences more likely be due to glibc and gcc like wonder said?

daf666 · 2009-06-15 18:51:39

scio wrote:

Wouldn't free and malloc differences more likely be due to glibc and gcc like wonder said?

Well I dont think that those other distributions use extreme settings like that, but I guess before switching the kernel I can try taking the executable itself which contains the bug that doesn't crash in Arch, and run it on Fedora.

Edit: typo

Last edited by daf666 (2009-06-15 18:52:27)

djgera · 2009-06-15 22:22:32

djgera wrote:

what is "lala" an extern or auto variable?

about this?

wonder · 2009-06-16 10:02:54

i'm sure that ubuntu has ssp enabled by default. searching on google about "ubuntu ssp" show that they had a plan and they did it in 2006.
https://wiki.ubuntu.com/GccSsp

daf666 · 2009-06-16 17:00:36

djgera wrote:

djgera wrote:
what is "lala" an extern or auto variable?
about this?

Sorry djgera, its a regular auto variable, dont think it matters though.

daf666 · 2009-06-16 17:01:21

wonder wrote:

i'm sure that ubuntu has ssp enabled by default. searching on google about "ubuntu ssp" show that they had a plan and they did it in 2006.
https://wiki.ubuntu.com/GccSsp

Hmm.. I see.. thanks.

djgera · 2009-06-16 22:55:56

daf666 wrote:

djgera wrote:
djgera wrote:
what is "lala" an extern or auto variable?
about this?
Sorry djgera, its a regular auto variable, dont think it matters though.

Yes matters, because an auto variable is on the stack, but no and extern/static variable, these are on data segment/bss.

(1)
*char *lala;
...
function
free(lala);

lala is initialized to 0 so free(0) is valid an no crash

(2)
char lala[2];
...
function
sprintf(lala, "bababa");

can't crash, you need to overwrite more than ~4Kb (1 page, that is the size of minimal data segment) to do a segmentation fault.

In the case of an auto variable, you are playing with more delicated data structure: the stack. So

*char *lala; free(lala); No crash if "lala" is zero,
char lala[2]; sprintf(lala, "bababa"); No crash because you need more bytes to overwrite the saved frame pointer or the return address.

daf666 · 2009-06-17 18:18:52

djgera wrote:

*char *lala; free(lala); No crash if "lala" is zero,
char lala[2]; sprintf(lala, "bababa"); No crash because you need more bytes to overwrite the saved frame pointer or the return address.

Nope,
1. *lala is not initialized like char *lala=NULL, the free crashes on Fedora (this is verified).
2. again, I can tell you for sure that writing to non allocated memory crashes on Fedora and not on Arch (consistently! - not just one random executable run).

Test it yourself if you want, I can also supply you with actual code with bugs that caused it.
Thanks for the effort!

Edit: I was testing on Fedora 10.

Last edited by daf666 (2009-06-17 18:21:02)

djgera · 2009-06-17 21:57:07

OK I just described the behaviour in normal and "mainline GCC" == "Arch Linux". Many mechanism exists in other GNU/Linux distros that patches GCC as you can see in above post about GCC+SSP and other features like fortify source in libraries. I don't have any experience with its.

In your Fedora 10, how looks the memory map of a simple application? What is the initial value that have an extern/static variable or pointer if you don't assing a value?

Last edited by djgera (2009-06-17 22:02:32)

Lux Perpetua · 2009-06-18 03:33:55

daf666 wrote:

Arch seems to be very forgiving about invalid free()'s like:
char *lala; free(lala);
And buffer overflows like:
char lala[2]; sprintf(lala, "bababa");.
It happened several times already, that programs I wrote ran smoothly on Arch (supposedly) but then crashed miserably in Ubunto and Fedora because of a memory allocation related bug.
Is there some kernel option in the default Arch kernel that makes this happen? are the Ubuntu/Fedora kernels compiled with more strict memory allocation check settings?

That code results in undefined behavior. That means all bets are off. It might crash, it might not. Not all invalid free()s will by caught by glibc, but I've had a couple that were (yes, on Arch). Did you recompile the program for each system, or is it the same executable running on all three Linuxes? In any case, I would be extremely skeptical of any conclusions drawn based on running such code.

feler · 2009-06-30 08:35:05

Arch GCC doesn't enable SSP by default, but you can enable it compiling with -fstack-protector (and disable it with -fno-stack-protector).

Try to compile in Arch with -fstack-protector and in Fedora with -fno-stack-protector.

djgera, que bueno ver a un argentino por aqui

Arch Linux

#1 2009-06-13 20:38:53

Memory allocation errors treatment in Arch.

#2 2009-06-13 23:12:28

Re: Memory allocation errors treatment in Arch.

#3 2009-06-13 23:29:25

Re: Memory allocation errors treatment in Arch.

#4 2009-06-13 23:40:59

Re: Memory allocation errors treatment in Arch.

#5 2009-06-15 17:17:40

Re: Memory allocation errors treatment in Arch.

#6 2009-06-15 18:00:34

Re: Memory allocation errors treatment in Arch.

#7 2009-06-15 18:51:39

Re: Memory allocation errors treatment in Arch.

#8 2009-06-15 22:22:32

Re: Memory allocation errors treatment in Arch.

#9 2009-06-16 10:02:54

Re: Memory allocation errors treatment in Arch.

#10 2009-06-16 17:00:36

Re: Memory allocation errors treatment in Arch.

#11 2009-06-16 17:01:21

Re: Memory allocation errors treatment in Arch.

#12 2009-06-16 22:55:56

Re: Memory allocation errors treatment in Arch.

#13 2009-06-17 18:18:52

Re: Memory allocation errors treatment in Arch.

#14 2009-06-17 21:57:07

Re: Memory allocation errors treatment in Arch.

#15 2009-06-18 03:33:55

Re: Memory allocation errors treatment in Arch.

#16 2009-06-30 08:35:05

Re: Memory allocation errors treatment in Arch.

Board footer