The iOS _MALLOC(size_t size, int type, int flags) function allocates size bytes on the heap. Internally blocks are represented as a length field followed by a data field:

struct _mhead {
size_t mlen;
char dat[0]; }

The mlen field is used by the free() function to determine how much space needs to be freed. In iOS 4.x the _MALLOC function was implemented as follows:

1 void * _MALLOC(size_t size, int type, int flags) {
2 struct _mhead *hdr;
3 size_t memsize = sizeof (*hdr) + size;
4 hdr = (void *)kalloc(memsize); // allocate memory
5 hdr->mlen = memsize;
6 return (hdr->dat);
7 }

In iOS 5.x the following two lines were added after line 3:

int o = memsize < size ? 1 : 0;
if (o) return (NULL);

Why were these lines added in iOS5.x? Briefly describe an attack that may be possible without these lines.