WCU / Cybersecurity
~/CSC 472/Class 09/KP 06
Class 09 · KP 06 / 25

The Bins: malloc's Free Lists

  • tcache (per-thread): small, fast, single-linked LIFO cache. First stop for small allocations (glibc 2.26+).
  • Fast bins: single-linked LIFO lists for small chunks; chunks are not coalesced, kept ready for quick reuse.
  • Unsorted bin: a temporary holding list; recently freed larger chunks land here before being sorted.
  • Small bins: double-linked lists, one exact size per bin.
  • Large bins: double-linked lists holding ranges of sizes, kept sorted.

Allocation order (roughly): tcache, then fast bins, then unsorted /

small / large, then split the top chunk (the wilderness).

Key Takeaway

Each bin type has different metadata and different checks — each is a distinct attack surface.