From 315415acf23dba73e109585567d08052d20eb3be Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Fri, 16 Nov 2018 03:26:07 -0500 Subject: [PATCH] clarify write-after-free detection feature --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 7dde83c..f97a534 100644 --- a/README.md +++ b/README.md @@ -195,6 +195,8 @@ was a bit less important and if a core goal was finding latent bugs. * [in-progress] Randomized choice of slabs * [in-progress] Randomized allocation of slabs * Slab allocations are zeroed on free +* Detection of write-after-free for slab allocations by verifying zero filling + is intact at allocation time * Large allocations are purged and memory protected on free with the memory mapping kept reserved in a quarantine to detect use-after-free * The quarantine is primarily based on a FIFO ring buffer, with the oldest @@ -203,7 +205,6 @@ was a bit less important and if a core goal was finding latent bugs. * Another layer of the quarantine swaps with a random slot in an array to randomize the number of large deallocations required to push mappings out of the quarantine -* Detection of write-after-free by verifying zero filling is intact * Memory in fresh allocations is consistently zeroed due to it either being fresh pages or zeroed on free after previous usage * Delayed free via a combination of FIFO and randomization for slab allocations