There are two main options for installing our heap protection system:

• system-wide heap protection through system glibc replacement
• alternative patched glibc image for selective per-application protection

The first option, to install one of our packages which replaces the system glibc image with a patched version, is the easiest deployment option. With the new glibc image in place, all applications which utilize glibc's dynamic memory management are automatically protected. If you do not care about selectively protecting applications, this is probably the best option.



The second option is for those who do not wish to enable system-wide heap protection. Reasons for this may range from stability concerns to specific performance requirements, all of which is quite understandable. Thus, we have provided a script that utilizes the system loader's LD_PRELOAD functionality in order to substitute a protected glibc image for the system image for individual applications. Consequently, administrators can decide on their own what level of protection they feel is necessary or required and implement that policy with this capability.



We provide both source patches to glibc and binary packages for select OSes and architectures for both of these installation options. For those running an unsupported OS or architecture, a source rebuild of the system glibc is currently the only recourse. Please only attempt this if you are familiar with the procedures for compiling and installing glibc for your platform, since a false step can easily render your system inoperable. We are open to adding more OSes and architectures on an on-demand basis.

To patch a glibc source tree with our heap protection system, you first need to select the proper patch. We currently provide a generic patch against the vanilla glibc source as downloadable from ftp.gnu.org and its mirrors.



Once the patch has been selected, the steps to patch a glibc source tree are simple. For example: You will also need to provide the --enable-heap-protection configuration directive to the configure script to activate the heap protection code. The rest of the glibc build should proceed as normal.

To install a binary heap-protected glibc image, you will generally need to first select either a system-wide installation or a per-application installation. To perform the first type of installation on a system, you should install a glibc-heapprotect package, while the second type requires the installation of a glibc-heapprotect-selective package.



For details on how to install binary packages on your OS, please refer to your vendor's documentation.

• Seed __heap_magic with randomness, not time(NULL). Fixes issue raised by Eugene Tsyrklevich.
• Fix vmalloc chunk magic bug found by Kyle Sallee.
• Update tst-random to account for heap protection srandom() call, fixes tst-random test case failure found by Kyle Sallee.

File	Platform	Arch.
heapprotect-2.3.2-1.4.diff.gz	All	All
glibc-heapprotect-selective-2.3.2-27.9.7.2.i386.rpm	RedHat 9	i386
glibc-heapprotect-2.3.2-27.9.7.2.i386.rpm	RedHat 9	i386
glibc-heapprotect-2.3.2-27.9.7.2.i386.tgz	RedHat 9	i386

• Remove x86 assembly from protection macros.
• Fix compilation warnings regarding missing chunk pointer casts within protection macros.

File	Platform	Arch.
heapprotect-2.3.2-1.3.1.diff.gz	All	All
glibc-heapprotect-selective-2.3.2-11.9.2.i386.rpm	RedHat 9	i386
glibc-heapprotect-2.3.2-11.9.2.i386.rpm	RedHat 9	i386