Merge branch 'master' of ssh://sources.redhat.com/git/glibc

Conflicts:
	ChangeLog

2 files changed, 20 insertions, 1 deletions

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 763852ea3b..0004c878f3 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4852,7 +4852,8 @@ _int_free(mstate av, mchunkptr p)
       free_perturb (chunk2mem(p), size - SIZE_SZ);
 
     set_fastchunks(av);
-    fb = &fastbin (av, fastbin_index(size));
+    unsigned int idx = fastbin_index(size);
+    fb = &fastbin (av, idx);
 
 #ifdef ATOMIC_FASTBINS
     mchunkptr fd;
@@ -4866,6 +4867,12 @@ _int_free(mstate av, mchunkptr p)
 	    errstr = "double free or corruption (fasttop)";
 	    goto errout;
 	  }
+	if (old != NULL
+	    && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
+	  {
+	    errstr = "invalid fastbin entry (free)";
+	    goto errout;
+	  }
 	p->fd = fd = old;
       }
     while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
@@ -4877,6 +4884,12 @@ _int_free(mstate av, mchunkptr p)
 	errstr = "double free or corruption (fasttop)";
 	goto errout;
       }
+    if (*fb != NULL
+	&& __builtin_expect (fastbin_index(chunksize(*fb)) != idx, 0))
+      {
+	errstr = "invalid fastbin entry (free)";
+	goto errout;
+      }
 
     p->fd = *fb;
     *fb = p;
diff --git a/malloc/tst-mallocstate.c b/malloc/tst-mallocstate.c
index 97a10586d3..2a1fd469ab 100644
--- a/malloc/tst-mallocstate.c
+++ b/malloc/tst-mallocstate.c
@@ -51,6 +51,7 @@ main (void)
 
   for (i=0; i<100; ++i)
     {
+printf("round %li\n", i);
       save_state = malloc_get_state ();
       if (save_state == NULL)
 	{
@@ -64,13 +65,18 @@ main (void)
 	merror ("realloc (i*4) failed.");
       free (save_state);
     }
+puts("done");
 
   p1 = realloc (p1, 40);
+puts("after realloc");
   free (p2);
+puts("after free 1");
   p2 = malloc (10);
+puts("after malloc");
   if (p2 == NULL)
     merror ("malloc (10) failed.");
   free (p1);
+puts("after free 2");
 
   return errors != 0;
 }