summary refs log tree commit diff
path: root/malloc
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2004-11-19 21:35:00 +0000
committerUlrich Drepper <drepper@redhat.com>2004-11-19 21:35:00 +0000
commit893e609847a2f372970e349e0cede2e8529bea71 (patch)
tree8f3b331c84468e5fae7ddc3cdc9262529f730053 /malloc
parent3defcff3991314ad57e9b63c37f5e6de9fd5e879 (diff)
downloadglibc-893e609847a2f372970e349e0cede2e8529bea71.tar.gz
glibc-893e609847a2f372970e349e0cede2e8529bea71.tar.xz
glibc-893e609847a2f372970e349e0cede2e8529bea71.zip
Update.
2004-11-19  Ulrich Drepper  <drepper@redhat.com>

	* malloc/malloc.c (_int_free): Add a few more cheap tests for
	corruption.

	* debug/fprintf_chk.c: Adjust all users.
Diffstat (limited to 'malloc')
-rw-r--r--malloc/malloc.c15
1 files changed, 14 insertions, 1 deletions
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 57074108f1..d6810be7f6 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4233,6 +4233,14 @@ _int_free(mstate av, Void_t* mem)
 #endif
       ) {
 
+    if (__builtin_expect (chunk_at_offset (p, size)->size <= 2 * SIZE_SZ, 0)
+	|| __builtin_expect (chunksize (chunk_at_offset (p, size))
+			     >= av->system_mem, 0))
+      {
+	errstr = "invalid next size (fast)";
+	goto errout;
+      }
+
     set_fastchunks(av);
     fb = &(av->fastbins[fastbin_index(size)]);
     /* Another simple check: make sure the top of the bin is not the
@@ -4276,7 +4284,12 @@ _int_free(mstate av, Void_t* mem)
       }
 
     nextsize = chunksize(nextchunk);
-    assert(nextsize > 0);
+    if (__builtin_expect (nextchunk->size <= 2 * SIZE_SZ, 0)
+	|| __builtin_expect (nextsize >= av->system_mem, 0))
+      {
+	errstr = "invalid next size (normal)";
+	goto errout;
+      }
 
     /* consolidate backward */
     if (!prev_inuse(p)) {