Date: Tue, 26 Apr 2011 16:23:11 +0200 From: "C. P. Ghost" <cpghost@cordula.ws> To: freebsd-questions@freebsd.org Subject: Re: Password theft from memory? Message-ID: <BANLkTikQzhmyXkCeSzzG-o%2Bz0L3ohNt2YQ@mail.gmail.com> In-Reply-To: <20110426104151.596bcc19@gumby.homeunix.com> References: <BANLkTimJWAxW_4OmoeBQrvDDLjD-5Vr5hQ@mail.gmail.com> <BANLkTin_S%2BBRWu79AH16tPdgZd%2BUgZQAzQ@mail.gmail.com> <20110425151846.0a5359fd@gumby.homeunix.com> <20110425151536.GA61425@stainmore> <BANLkTinvvWhEy_A5ao=XWTpQOSTX0Vm2_A@mail.gmail.com> <20110425175420.GA61811@stainmore> <20110425232908.4104e026@gumby.homeunix.com> <20110426025614.GA62745@stainmore> <20110426104151.596bcc19@gumby.homeunix.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Apr 26, 2011 at 11:41 AM, RW <rwmaillists@googlemail.com> wrote: >> The above quote states that the memory not occupied by the remapped >> object is zero filled. Which is to say that memory allocated by mmap() >> is either filled with new data or filled with zeros. > > In context it says: > > =A0 =A0 "If len is not a multiple of the page-size, the mapped region may > =A0 =A0 extend past the specified range. =A0Any such extension beyond the > =A0 =A0 end of the mapped object will be zero-filled." > > To me the most straightforward reading of that is that it's referring > to non-aligned address ranges. > > Your interpretation may well be the intended one, but where would that > leave the anonymous mappings used by malloc? Are we to think of them as > extensions beyond a non-existent mapped object, and thus infer that they > are zero-filled? It's a bit of a stretch from what's written. While it's not a *proof*, you could always do a little bit of black box testing. 1, So how about a little C program scanner.c that allocates a huge heap via mmap(2)'s malloc(3) backend, and crawls that buffer, looking for the first non-zero byte? If we always get zero-filled pages, you shouldn't find any non-zero bytes there. 2. For good measure, another program filler.c could fill a huge heap with a particular easily recognizable pattern (say something like 0xdeadbeef), and exit; and then, scanner.c could not only check for non-zero byes, but also for that particular pattern. -cpghost. --=20 Cordula's Web. http://www.cordula.ws/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?BANLkTikQzhmyXkCeSzzG-o%2Bz0L3ohNt2YQ>