about summary refs log tree commit diff
diff options
context:
space:
mode:
authorH.J. Lu <hjl.tools@gmail.com>2012-09-08 15:36:50 -0700
committerH.J. Lu <hjl.tools@gmail.com>2012-09-08 15:36:50 -0700
commit67d875851e833ab93dd8aa5fb934e79d094da48d (patch)
tree8623c1b2f9eb472c05cab2a8a29dd29587c0bd1b
parent3d9b46b3500566163815747173002d3d0bbb9b2f (diff)
downloadglibc-67d875851e833ab93dd8aa5fb934e79d094da48d.tar.gz
glibc-67d875851e833ab93dd8aa5fb934e79d094da48d.tar.xz
glibc-67d875851e833ab93dd8aa5fb934e79d094da48d.zip
Properly handle fencepost with MALLOC_ALIGN_MASK hjl/pr14562/master
-rw-r--r--ChangeLog.pr145625
-rw-r--r--malloc/arena.c7
2 files changed, 10 insertions, 2 deletions
diff --git a/ChangeLog.pr14562 b/ChangeLog.pr14562
new file mode 100644
index 0000000000..b92843d223
--- /dev/null
+++ b/ChangeLog.pr14562
@@ -0,0 +1,5 @@
+2012-09-08  H.J. Lu  <hongjiu.lu@intel.com>
+
+	[BZ #14562]
+	* malloc/arena.c (heap_trim): Properly get fencepost and adjust
+	new chunk size with MALLOC_ALIGN_MASK.
diff --git a/malloc/arena.c b/malloc/arena.c
index 97c0b909cc..dd4f3e343c 100644
--- a/malloc/arena.c
+++ b/malloc/arena.c
@@ -655,15 +655,18 @@ heap_trim(heap_info *heap, size_t pad)
   unsigned long pagesz = GLRO(dl_pagesize);
   mchunkptr top_chunk = top(ar_ptr), p, bck, fwd;
   heap_info *prev_heap;
-  long new_size, top_size, extra;
+  long new_size, top_size, extra, misalign;
 
   /* Can this heap go away completely? */
   while(top_chunk == chunk_at_offset(heap, sizeof(*heap))) {
     prev_heap = heap->prev;
     p = chunk_at_offset(prev_heap, prev_heap->size - (MINSIZE-2*SIZE_SZ));
+    /* fencepost must be properly aligned.  */
+    misalign = ((long) p) & MALLOC_ALIGN_MASK;
+    p = (mchunkptr)(((unsigned long) p) & ~MALLOC_ALIGN_MASK);
     assert(p->size == (0|PREV_INUSE)); /* must be fencepost */
     p = prev_chunk(p);
-    new_size = chunksize(p) + (MINSIZE-2*SIZE_SZ);
+    new_size = chunksize(p) + (MINSIZE-2*SIZE_SZ) + misalign;
     assert(new_size>0 && new_size<(long)(2*MINSIZE));
     if(!prev_inuse(p))
       new_size += p->prev_size;