Demystifying the Secure Enclave Processor

Heap Corruptions: malloc()
• Runtime allocator leveraged by SEP applications
▫ K&R implementation
• Singly linked free list (ordered by size) with
header that includes pointer and block size
▫ struct Header { void * ptr, size_t size };
▫ Coalesces adjacent elements on free()
• Size of heap determined on initialization
▫ malloc_init( malloc_base, malloc_top );
▫ Non-expandable