Merge branch 'master' of ssh://sources.redhat.com/git/glibc

Conflicts:
	ChangeLog

4 files changed, 25 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 6029367106..3845cafc25 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,10 @@
 	* sysdeps/unix/sysv/linux/clock_gettime.c: Likewise.
 	* sysdeps/unix/sysv/linux/clock_settime.c: Likewise.
 
+2010-03-25  Andreas Schwab  <schwab@redhat.com>
+
+	* sysdeps/posix/cuserid.c: Fix typo.
+
 2010-03-16  Chris Demetriou  <cgd@google.com>
 
 	[BZ #11394]
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 763852ea3b..0004c878f3 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4852,7 +4852,8 @@ _int_free(mstate av, mchunkptr p)
       free_perturb (chunk2mem(p), size - SIZE_SZ);
 
     set_fastchunks(av);
-    fb = &fastbin (av, fastbin_index(size));
+    unsigned int idx = fastbin_index(size);
+    fb = &fastbin (av, idx);
 
 #ifdef ATOMIC_FASTBINS
     mchunkptr fd;
@@ -4866,6 +4867,12 @@ _int_free(mstate av, mchunkptr p)
 	    errstr = "double free or corruption (fasttop)";
 	    goto errout;
 	  }
+	if (old != NULL
+	    && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
+	  {
+	    errstr = "invalid fastbin entry (free)";
+	    goto errout;
+	  }
 	p->fd = fd = old;
       }
     while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
@@ -4877,6 +4884,12 @@ _int_free(mstate av, mchunkptr p)
 	errstr = "double free or corruption (fasttop)";
 	goto errout;
       }
+    if (*fb != NULL
+	&& __builtin_expect (fastbin_index(chunksize(*fb)) != idx, 0))
+      {
+	errstr = "invalid fastbin entry (free)";
+	goto errout;
+      }
 
     p->fd = *fb;
     *fb = p;
diff --git a/malloc/tst-mallocstate.c b/malloc/tst-mallocstate.c
index 97a10586d3..2a1fd469ab 100644
--- a/malloc/tst-mallocstate.c
+++ b/malloc/tst-mallocstate.c
@@ -51,6 +51,7 @@ main (void)
 
   for (i=0; i<100; ++i)
     {
+printf("round %li\n", i);
       save_state = malloc_get_state ();
       if (save_state == NULL)
 	{
@@ -64,13 +65,18 @@ main (void)
 	merror ("realloc (i*4) failed.");
       free (save_state);
     }
+puts("done");
 
   p1 = realloc (p1, 40);
+puts("after realloc");
   free (p2);
+puts("after free 1");
   p2 = malloc (10);
+puts("after malloc");
   if (p2 == NULL)
     merror ("malloc (10) failed.");
   free (p1);
+puts("after free 2");
 
   return errors != 0;
 }
diff --git a/sysdeps/posix/cuserid.c b/sysdeps/posix/cuserid.c
index f30c20e3f8..a74ff84368 100644
--- a/sysdeps/posix/cuserid.c
+++ b/sysdeps/posix/cuserid.c
@@ -44,6 +44,6 @@ cuserid (s)
 
   if (s == NULL)
     s = name;
-  s[L_userid - 1] = '\0';
+  s[L_cuserid - 1] = '\0';
   return strncpy (s, pwptr->pw_name, L_cuserid - 1);
 }