lib/glibc
1
0
Fork 0
mirror of https://sourceware.org/git/glibc.git synced 2025-07-29 11:41:21 +03:00
Code Activity

Update.

Browse Source 
2004-11-19  Ulrich Drepper  <drepper@redhat.com>

	* malloc/malloc.c (_int_free): Add a few more cheap tests for
	corruption.

	* debug/fprintf_chk.c: Adjust all users.
This commit is contained in:
Ulrich Drepper
2004-11-19 21:35:00 +00:00
parent 3defcff399
commit 893e609847
2 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ChangeLog
View File

@ -1,3 +1,8 @@
2004-11-19 Ulrich Drepper <drepper@redhat.com>
* malloc/malloc.c (_int_free): Add a few more cheap tests for
corruption.
2004-11-17 Randolph Chung <tausq@debian.org> 2004-11-17 Randolph Chung <tausq@debian.org>
* sysdeps/hppa/dl-machine.h (TRAMPOLINE_TEMPLATE): Add unwind * sysdeps/hppa/dl-machine.h (TRAMPOLINE_TEMPLATE): Add unwind
@ -27,7 +32,7 @@
* libio/libio.h (_IO_FLAGS2_FORTIFY): Renamed from * libio/libio.h (_IO_FLAGS2_FORTIFY): Renamed from
_IO_FLAGS2_CHECK_PERCENT_N. _IO_FLAGS2_CHECK_PERCENT_N.
* debug/fprintff_chk.c: Adjust all users. * debug/fprintf_chk.c: Adjust all users.
* debug/printf_chk.c: Likewise. * debug/printf_chk.c: Likewise.
* debug/vfprintf_chk.c: Likewise. * debug/vfprintf_chk.c: Likewise.
* debug/vprintf_chk.c: Likewise. * debug/vprintf_chk.c: Likewise.

15
malloc/malloc.c
View File

@ -4233,6 +4233,14 @@ _int_free(mstate av, Void_t* mem)
#endif #endif
) { ) {
if (__builtin_expect (chunk_at_offset (p, size)->size <= 2 * SIZE_SZ, 0)
|| __builtin_expect (chunksize (chunk_at_offset (p, size))
>= av->system_mem, 0))
{
errstr = "invalid next size (fast)";
goto errout;
}
set_fastchunks(av); set_fastchunks(av);
fb = &(av->fastbins[fastbin_index(size)]); fb = &(av->fastbins[fastbin_index(size)]);
/* Another simple check: make sure the top of the bin is not the /* Another simple check: make sure the top of the bin is not the
@ -4276,7 +4284,12 @@ _int_free(mstate av, Void_t* mem)
} }
nextsize = chunksize(nextchunk); nextsize = chunksize(nextchunk);
assert(nextsize > 0); if (__builtin_expect (nextchunk->size <= 2 * SIZE_SZ, 0)
|| __builtin_expect (nextsize >= av->system_mem, 0))
{
errstr = "invalid next size (normal)";
goto errout;
}
/* consolidate backward */ /* consolidate backward */
if (!prev_inuse(p)) { if (!prev_inuse(p)) {