AuroraMiddleware/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2024-11-25 22:40:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update.

Browse Source 
* malloc/malloc.c (_int_malloc): Check for corruption of chunk
	which is about to be returned.
This commit is contained in:
Ulrich Drepper 2004-11-20 04:45:06 +00:00
parent 893e609847
commit 6cce65407e
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
ChangeLog
View File

@ -1,5 +1,8 @@
2004-11-19 Ulrich Drepper <drepper@redhat.com> 2004-11-19 Ulrich Drepper <drepper@redhat.com>
* malloc/malloc.c (_int_malloc): Check for corruption of chunk
which is about to be returned.
* malloc/malloc.c (_int_free): Add a few more cheap tests for * malloc/malloc.c (_int_free): Add a few more cheap tests for
corruption. corruption.

10
malloc/malloc.c
View File

@ -3840,8 +3840,12 @@ _int_malloc(mstate av, size_t bytes)
*/ */
if ((unsigned long)(nb) <= (unsigned long)(av->max_fast)) { if ((unsigned long)(nb) <= (unsigned long)(av->max_fast)) {
fb = &(av->fastbins[(fastbin_index(nb))]); long int idx = fastbin_index(nb);
fb = &(av->fastbins[idx]);
if ( (victim = *fb) != 0) { if ( (victim = *fb) != 0) {
if (__builtin_expect (fastbin_index (chunksize (victim)) != idx, 0))
malloc_printerr (check_action, "malloc(): memory corruption (fast)",
chunk2mem (victim));
*fb = victim->fd; *fb = victim->fd;
check_remalloced_chunk(av, victim, nb); check_remalloced_chunk(av, victim, nb);
return chunk2mem(victim); return chunk2mem(victim);
@ -3911,6 +3915,10 @@ _int_malloc(mstate av, size_t bytes)
while ( (victim = unsorted_chunks(av)->bk) != unsorted_chunks(av)) { while ( (victim = unsorted_chunks(av)->bk) != unsorted_chunks(av)) {
bck = victim->bk; bck = victim->bk;
if (__builtin_expect (victim->size <= 2 * SIZE_SZ, 0)
|| __builtin_expect (victim->size > av->system_mem, 0))
malloc_printerr (check_action, "malloc(): memory corruption",
chunk2mem (victim));
size = chunksize(victim); size = chunksize(victim);
/* /*