New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Starred by 4 users

Issue metadata

Status: Fixed
Closed: Jan 2012
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug

  • Only users with EditIssue permission may comment.

Sign in to add a comment

Issue 104752: Add guard pages for TCMalloc metadata

Reported by, Nov 18 2011 Project Member

Issue description

It's possible to get the TCMalloc metadata pages allocated inline with normal user-controllable data. This means that a buffer overrun in a properly laid out address space could lead to a generic exploit against TCMalloc. This is even more likely on Unix-based system due to how the allocator is implemented. The easiest solution seems to be just adding a guard page in front of the metadata.

Comment 2 by, Dec 19 2011

Labels: -Mstone-17 Mstone-18 MovedFrom-17
Moving bugs marked as Started but not blockers from M17 to M18.  Please move back if you think this is a blocker, and add the ReleaseBlock-Stable label.  If you're able.

Comment 3 by, Jan 19 2012

Status: Fixed

Comment 4 by, Jan 20 2012

Labels: -Mstone-18 Mstone-17
This made in into M17, nice.

Comment 5 by, Oct 13 2012

Project Member
Labels: Restrict-AddIssueComment-Commit
This issue has been closed for some time. No one will pay attention to new comments.
If you are seeing this bug or have new data, please click New Issue to start a new bug.

Comment 6 by, Mar 10 2013

Project Member
Labels: -Area-Internals -Feature-Security -Mstone-17 Cr-Security Cr-Internals M-17

Comment 7 by, Mar 13 2013

Project Member
Labels: -Restrict-AddIssueComment-Commit Restrict-AddIssueComment-EditIssue

Comment 8 by, Oct 2

Project Member
The following revision refers to this bug:

commit 22d691ec9f38a77c7ecbee9363c7f44663824baf
Author: Gabriel Marin <>
Date: Tue Oct 02 21:11:39 2018

tcmalloc: add a guard page in front of metadata allocations

Based on original CL:

  Add a guard page in front of metadata allocations.

  BUG= 104752 

Code has been modified to create the guard page inside MetaDataAlloc,
once per 8MB chunk.


Change-Id: I527fbfe5e258cc052e205d01bfe2dd30e21b9f13
Reviewed-by: Will Harris <>
Commit-Queue: Gabriel Marin <>
Cr-Commit-Position: refs/heads/master@{#595983}

Sign in to add a comment