diff options
| -rw-r--r-- | ChangeLog | 6 | ||||
| -rw-r--r-- | malloc/hooks.c | 22 |
2 files changed, 20 insertions, 8 deletions
diff --git a/ChangeLog b/ChangeLog index 12a7011b23..a33df5d4f7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +2004-10-19 Wolfram Gloger <wg@malloc.de> + + * malloc/hooks.c (mem2chunk_check, top_check): Handle + non-contiguous arena. Reported by Michael Dalton + <mwdalton@stanford.edu> [BZ #457]. Add further checks for top chunk. + 2004-12-14 Jakub Jelinek <jakub@redhat.com> * sysdeps/posix/sysconf.c (__sysconf_check_spec): Remove leading diff --git a/malloc/hooks.c b/malloc/hooks.c index 8a94fd0be8..a5c97f3133 100644 --- a/malloc/hooks.c +++ b/malloc/hooks.c @@ -157,15 +157,16 @@ mem2chunk_check(mem) Void_t* mem; if(!aligned_OK(mem)) return NULL; p = mem2chunk(mem); - if( (char*)p>=mp_.sbrk_base && - (char*)p<(mp_.sbrk_base+main_arena.system_mem) ) { + if (!chunk_is_mmapped(p)) { /* Must be a chunk in conventional heap memory. */ - if(chunk_is_mmapped(p) || - ( (sz = chunksize(p)), - ((char*)p + sz)>=(mp_.sbrk_base+main_arena.system_mem) ) || + int contig = contiguous(&main_arena); + sz = chunksize(p); + if((contig && + ((char*)p<mp_.sbrk_base || + ((char*)p + sz)>=(mp_.sbrk_base+main_arena.system_mem) )) || sz<MINSIZE || sz&MALLOC_ALIGN_MASK || !inuse(p) || ( !prev_inuse(p) && (p->prev_size&MALLOC_ALIGN_MASK || - (long)prev_chunk(p)<(long)mp_.sbrk_base || + (contig && (char*)prev_chunk(p)<mp_.sbrk_base) || next_chunk(prev_chunk(p))!=p) )) return NULL; magic = MAGICBYTE(p); @@ -213,8 +214,13 @@ top_check() INTERNAL_SIZE_T front_misalign, sbrk_size; unsigned long pagesz = malloc_getpagesize; - if((char*)t + chunksize(t) == mp_.sbrk_base + main_arena.system_mem || - t == initial_top(&main_arena)) return 0; + if (t == initial_top(&main_arena) || + (!chunk_is_mmapped(t) && + chunksize(t)>=MINSIZE && + prev_inuse(t) && + (!contiguous(&main_arena) || + (char*)t + chunksize(t) == mp_.sbrk_base + main_arena.system_mem))) + return 0; malloc_printerr (check_action, "malloc: top chunk is corrupt", t); |