aboutsummaryrefslogtreecommitdiff
path: root/malloc/malloc.c
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2005-10-13 04:48:35 +0000
committerUlrich Drepper <drepper@redhat.com>2005-10-13 04:48:35 +0000
commitbf58906631af8fe0d57625988b1d003cc09ef01d (patch)
treebece252e69676134a5c51316326d8d3821c12a47 /malloc/malloc.c
parent04ec80e410b4efb0576a2ffd0d2f29ed1fdac451 (diff)
downloadglibc-bf58906631af8fe0d57625988b1d003cc09ef01d.tar
glibc-bf58906631af8fe0d57625988b1d003cc09ef01d.tar.gz
glibc-bf58906631af8fe0d57625988b1d003cc09ef01d.tar.bz2
glibc-bf58906631af8fe0d57625988b1d003cc09ef01d.zip
* malloc/malloc.c (_int_free): Fail if block size is obviously wrong.
Diffstat (limited to 'malloc/malloc.c')
-rw-r--r--malloc/malloc.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/malloc/malloc.c b/malloc/malloc.c
index a8bc76739f..4ea35254bb 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4278,6 +4278,12 @@ _int_free(mstate av, Void_t* mem)
malloc_printerr (check_action, errstr, mem);
return;
}
+ /* We know that each chunk is at least MINSIZE bytes in size. */
+ if (__builtin_expect (size < MINSIZE, 0))
+ {
+ errstr = "free(): invalid size";
+ goto errout;
+ }
check_inuse_chunk(av, p);