iOS Kernel Heap Armageddon

_MALLOC() in iOS 4.x
void *_MALLOC(size_t size, int type, int flags)
{
struct _mhead *hdr;
size_t memsize = sizeof (*hdr) + size;
}
if (type >= M_LAST)
panic("_malloc TYPE");
if (size == 0)
return (NULL);
if (flags & M_NOWAIT) {
hdr = (void *)kalloc_noblock(memsize);
} else {
hdr = (void *)kalloc(memsize);
...
}
...
hdr->mlen = memsize;
return (hdr->dat);
refuses to allocate
0 byte big blocks
Stefan Esser • iOS Kernel Heap Armageddon • April 2012 •
possible integer overflow
with huge size values
struct _mhead {
size_t mlen;
char dat[0];
}
21