<story><title>System memory allocator free operation zeroes out deallocated blocks in iOS 16</title><url>https://mjtsai.com/blog/2022/09/20/zeroing-freed-memory/</url></story><parent_chain><item><author>cesarb</author><text>I wonder how long until programs start to accidentally depend on it, the same way some programs currently accidentally depend on freeing memory not immediately overwriting it.&lt;p&gt;For instance, I can imagine a program which accidentally follows a dangling pointer to an already freed structure, and reads another pointer from within that structure, not crashing because it ends up checking this later pointer against NULL... until the stars align and the memory used by the freed structure has been returned to the operating system, or overwritten by a later allocation.</text></item></parent_chain><comment><author>pjscott</author><text>I urge anybody using a C family language to become familiar with AddressSanitizer [1], a tool that (with support from the compiler) detects an impressive variety of memory bugs at runtime. The scenario you describe would result in the program immediately crashing with a read-after-free error, along with stack traces for the most recent calls to malloc and free that involved that address. It&amp;#x27;s remarkably useful and straightforward, and Apple&amp;#x27;s tooling has good support for it, along with Xcode integration [2].&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;clang.llvm.org&amp;#x2F;docs&amp;#x2F;AddressSanitizer.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;clang.llvm.org&amp;#x2F;docs&amp;#x2F;AddressSanitizer.html&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;documentation&amp;#x2F;xcode&amp;#x2F;diagnosing-memory-thread-and-crash-issues-early&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;documentation&amp;#x2F;xcode&amp;#x2F;diagnosing-m...&lt;/a&gt;</text></comment>
<story><title>System memory allocator free operation zeroes out deallocated blocks in iOS 16</title><url>https://mjtsai.com/blog/2022/09/20/zeroing-freed-memory/</url></story><parent_chain><item><author>cesarb</author><text>I wonder how long until programs start to accidentally depend on it, the same way some programs currently accidentally depend on freeing memory not immediately overwriting it.&lt;p&gt;For instance, I can imagine a program which accidentally follows a dangling pointer to an already freed structure, and reads another pointer from within that structure, not crashing because it ends up checking this later pointer against NULL... until the stars align and the memory used by the freed structure has been returned to the operating system, or overwritten by a later allocation.</text></item></parent_chain><comment><author>tlb</author><text>On Mac, malloc has several options to help find such bugs. If you set MallocScribble=1 in the environment, it fills blocks with 0xaa on alloc and 0x55 on free.&lt;p&gt;On Linux, running `env MALLOC_PERTURB_=43605 myprogram` will do the same.</text></comment>