Hi

I have a query regarding heap metadata

I want to get the address of forward pointer and backward pointer stored , how to print it using gdb

@user143252 the allocator re-interprets the contents of the chunk to contain those pointers – GDB doesn't know directly about this. Instead, you'll have to calculate offsets manually, or dump the contents of a freed pointer like with x/2w the_pointer (dump two words in hex-notation). In glibc, first word is forward pointer, second word is backwards pointer (might be unused). And the word before the pointer would contain the size field.

If you have a struct that describes the chunk layout, you could also cast to that struct. E.g. struct chunk { size_t fd, bk; }; then p *(struct chunk*) the_pointer

@amon in most of malloc metadata document it shows that forward pointer backward pointer is next to playload, but when I see the hex of malloc address-8, it contain only size information , no where forward pointer or backward pointer. So my question is where Exactly is these address resides in memory if not next to payload

So I actually wrote a paper about glibc malloc metadata, and created this diagram to explain where the chunk header fields are:

the size field is just before the address of the chunk

but the fd/bk fields re-use the space where there would usually be user data

these fd/bk fields only exist for chunks that are freed and are stored in one of the allocator bins

the details also depend on the exact version of the allocator. The above diagram matches all ptmalloc2/glibc allocators, but there are significant differences between versions regarding when which field is active

other allocators (like BSD, Windows, tcmalloc) work differently

That means if I just allocated a memory then it should NOT have p->fd and p->bk field my environment is linux glibc-2. 27

@amon can you share your document on heap

correct! These fields do not exist for in-use chunks, only for freed chunks. So to observe them, you'd have to do a use-after-free: free(p); forward_pointer = *(size_t**)p;

The paper is called Shadow-Heap and can be downloaded from here: lukasatkinson.de/research

This is my scenario, here I am printing metadata from malloc allocation but I am getting fd ptr and bk ptr, moreover both pointer are SAME strange!

ibb.co/pK7csKv

That means some nasty peice of code is freeing it

THANKS A LOT, I hope this solves my problem

no, I think you're asking that heap addon to your debugger to interpret the chunk as if it were freed, and it's mis-interpreting data from the actual struct. The metadata in the chunk doesn't directly explain whether the chunk is free or in use (you'd have to look at the prev-in-use flag of the next chunk

For the chunk I am asking status is [flag =PREVIN_USE ] but I am not sure how to go to next chunk, do u know any command or you have idea?

I think COMMAND heap chunks may help me