We (I and @ironore15) According to our evaluation, SlimGuard's invalid check is insufficient.
Is it bug? or just design issue?
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <malloc.h>
void* p[256];
uintptr_t buf[256];
int main() {
buf[119] = 48;
fprintf(stderr, "%p\n", buf[121]);
free(&buf[120]);
fprintf(stderr, "%p\n", buf[121]);
}
LD_PRELOAD=$(pwd)/libSlimGuard.so ./poc
(nil)
0x7fda100008d0
Best,
Insu Yun.