Scientific Programming

Research Article

A Pattern-Based Software Testing Framework for Exploitability Evaluation of Metadata Corruption Vulnerabilities

Table 5

Typical mapping relation for a heap allocator.
o
AC1.LFi=<0,0,0,c1,c2, …,cN-1>,cA = cN
¬C1∧C2.LSi=<0,0,1,c2, …,cN>,cA = c1
¬C1∧¬C2∧C3ChBins(.LL,.LS),.U=Nul, cA = c1
¬C1∧¬C2∧¬C3∧C4Split(c1,ci,cj) ∧ci.sc = size, cA = ci, ChBins(.LL,.LS),.U=Nul
¬C1∧¬C2∧¬C3∧¬C4∧C5Split(ck,ci,cj) ∧ci.sc = size, cA = ci,ChSpl(cj)
¬C1∧¬C2∧¬C3∧¬C4∧¬C5∧.LSi=<0,0,1,c2, …,cN>,cA = c1
¬C1∧¬C2∧¬C3∧¬C4∧¬C5∧¬∧Split(c1,ci,cj) ∧ci.sc = size, cA = ci, ChBins(.LL,.LS),.U=Nul
¬C1∧¬C2∧¬C3∧¬C4∧¬C5∧¬∧¬∧C6Split(T,ci,cj) ∧ci.sc = size, cA = ci,T.sc = cj.sc
FC7.LFi=<0,0,0,c1,c2, …,cN,cF>
¬C7∧C8Merge(cL,cF),.U=<1,0,1,c1,c2, …,cN,cL>
¬C7∧¬C8∧C9Merge(T,cF)
¬C7∧¬C8∧¬C9∧C10Merge(cF,cH),.U=<1,0,1,c1,c2, …,cN,cF>
A, allocation; , deallocation; reallocation can be regarded as one of these. The allocator needs to check and again after checking the previous 5 conditions.