Identify Heap Corruption
Learn how to identify heap regions and heap corruption.
What is heap corruption?
In a process, heap memory is used for the dynamic allocation of memory. There are several reasons why this memory can get corrupted. For example, when processes do any of the following:
Overwrite the allocated bounds of some variable
Use pointers that point to unallocated or freed-up memory
Use uninitialized pointers
Application source code
We have created a multi-threaded application that encounters heap corruption.
Press + to interact
// Build:// gcc main.c -pthread -static -o App4#include <stdio.h>#include <pthread.h>#include <unistd.h>#include <string.h>#include <stdlib.h>void proc(){sleep(1);char *p1 = (char *) malloc (256);char *p2 = (char *) malloc (256);char *p3 = (char *) malloc (256);char *p4 = (char *) malloc (256);char *p5 = (char *) malloc (256);char *p6 = (char *) malloc (256);char *p7 = (char *) malloc (256);free(p6);free(p4);free(p2);strcpy(p2, "Hello Crash2! Hello Crash2! Hello Crash2! Hello Crash2! Hello Crash2!");strcpy(p4, "Hello Crash4! Hello Crash4! Hello Crash4! Hello Crash4! Hello Crash4! Hello Crash4!");strcpy(p6, "Hello Crash6! Hello Crash6! Hello Crash6! Hello Crash6! Hello Crash6! Hello Crash6! Hello Crash6!");p2 = (char *) malloc (256);p4 = (char *) malloc (256);p6 = (char *) malloc (256);sleep(300);free (p7);free (p6);free (p5);free (p4);free (p3);free (p2);free (p1);sleep(-1);}#define THREAD_DECLARE(num,func) void bar_##num()\{\func;\}\\void foo_##num()\{\bar_##num();\}\\void * thread_##num (void *arg)\{\foo_##num();\\return 0;\}THREAD_DECLARE(one,sleep(-1))THREAD_DECLARE(two,sleep(-1))THREAD_DECLARE(three,proc())THREAD_DECLARE(four,sleep(-1))THREAD_DECLARE(five,sleep(-1))#define THREAD_CREATE(num) {pthread_t threadID_##num; pthread_create (&threadID_##num, NULL, thread_##num, NULL);}int main(int argc, const char * argv[]){THREAD_CREATE(one)THREAD_CREATE(two)THREAD_CREATE(three)THREAD_CREATE(four)THREAD_CREATE(five)sleep(-1);return 0;}
Loading the core dump
The first step, as we already know, is to load the core dump file in GDB and see what actually caused our application to run into a segmentation fault. ...