aboutsummaryrefslogtreecommitdiff
path: root/malloc
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2010-03-25 19:45:20 -0700
committerUlrich Drepper <drepper@redhat.com>2010-03-25 19:45:20 -0700
commit70c90289ff7e2f1ca976618bcf342d9c65c746fc (patch)
treeb137a73907e3abed69bafe89483de0af3ce2b814 /malloc
parent89a4419cc384c090b1eabe610647aa4e14436a3f (diff)
parent34b514dff6acf8f1cac0afefd24049e025fd62ea (diff)
downloadglibc-70c90289ff7e2f1ca976618bcf342d9c65c746fc.tar
glibc-70c90289ff7e2f1ca976618bcf342d9c65c746fc.tar.gz
glibc-70c90289ff7e2f1ca976618bcf342d9c65c746fc.tar.bz2
glibc-70c90289ff7e2f1ca976618bcf342d9c65c746fc.zip
Merge branch 'master' of ssh://sources.redhat.com/git/glibc
Conflicts: ChangeLog
Diffstat (limited to 'malloc')
-rw-r--r--malloc/malloc.c15
-rw-r--r--malloc/tst-mallocstate.c6
2 files changed, 20 insertions, 1 deletions
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 763852ea3b..0004c878f3 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4852,7 +4852,8 @@ _int_free(mstate av, mchunkptr p)
free_perturb (chunk2mem(p), size - SIZE_SZ);
set_fastchunks(av);
- fb = &fastbin (av, fastbin_index(size));
+ unsigned int idx = fastbin_index(size);
+ fb = &fastbin (av, idx);
#ifdef ATOMIC_FASTBINS
mchunkptr fd;
@@ -4866,6 +4867,12 @@ _int_free(mstate av, mchunkptr p)
errstr = "double free or corruption (fasttop)";
goto errout;
}
+ if (old != NULL
+ && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
+ {
+ errstr = "invalid fastbin entry (free)";
+ goto errout;
+ }
p->fd = fd = old;
}
while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
@@ -4877,6 +4884,12 @@ _int_free(mstate av, mchunkptr p)
errstr = "double free or corruption (fasttop)";
goto errout;
}
+ if (*fb != NULL
+ && __builtin_expect (fastbin_index(chunksize(*fb)) != idx, 0))
+ {
+ errstr = "invalid fastbin entry (free)";
+ goto errout;
+ }
p->fd = *fb;
*fb = p;
diff --git a/malloc/tst-mallocstate.c b/malloc/tst-mallocstate.c
index 97a10586d3..2a1fd469ab 100644
--- a/malloc/tst-mallocstate.c
+++ b/malloc/tst-mallocstate.c
@@ -51,6 +51,7 @@ main (void)
for (i=0; i<100; ++i)
{
+printf("round %li\n", i);
save_state = malloc_get_state ();
if (save_state == NULL)
{
@@ -64,13 +65,18 @@ main (void)
merror ("realloc (i*4) failed.");
free (save_state);
}
+puts("done");
p1 = realloc (p1, 40);
+puts("after realloc");
free (p2);
+puts("after free 1");
p2 = malloc (10);
+puts("after malloc");
if (p2 == NULL)
merror ("malloc (10) failed.");
free (p1);
+puts("after free 2");
return errors != 0;
}