ptmalloc中BINS的数量
Author: zh-explorerCreated Nov 26, 2019Updated Sep 30, 2024
不懂就问Orz。 ptmalloc的malloc_state结果体的bins字段一共声明了127个bin。其中第一个为unsortbin，后面62个为normal bin。然后是63个large bin。那么第127个bin干什么用去了Orz。 另外，按照注释应该存在第64个larger bin用来放超过范围的其他所有chunk
Bins for sizes < 512 bytes contain chunks of all the same size, spaced
--
8 bytes apart. Larger bins are approximately logarithmically spaced:
64 bins of size 8
32 bins of size 64
16 bins of size 512
8 bins of size 4096
4 bins of size 32768
2 bins of size 262144
1 bin of size what's left但是在largebin_index 宏中超过大小的所有chunk放在第126个bin，也就是第63个largebin中。
#define largebin_index_64(sz) \
(((((unsigned long) (sz)) >> 6) <= 48) ? 48 + (((unsigned long) (sz)) >> 6) :\
((((unsigned long) (sz)) >> 9) <= 20) ? 91 + (((unsigned long) (sz)) >> 9) :\
((((unsigned long) (sz)) >> 12) <= 10) ? 110 + (((unsigned long) (sz)) >> 12) :\
((((unsigned long) (sz)) >> 15) <= 4) ? 119 + (((unsigned long) (sz)) >> 15) :\
((((unsigned long) (sz)) >> 18) <= 2) ? 124 + (((unsigned long) (sz)) >> 18) :\
126)
#define largebin_index(sz) \
(SIZE_SZ == 8 ? largebin_index_64 (sz) \
: MALLOC_ALIGNMENT == 16 ? largebin_index_32_big (sz) \
: largebin_index_32 (sz))存在什么说法或者我算的有问题么？
Source: ctf-wiki/ctf-wiki