This is the mail archive of the libc-alpha@sources.redhat.com mailing list for the glibc project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[BZ #457] Patch for MALLOC_CHECK_ with non-contiguous arena


Hi,

The appended patch was verified by the bug reporter as a fix
for Bugzilla #457.

Regards,
Wolfram.

2004-10-19  Wolfram Gloger  <wg@malloc.de>

	* malloc/hooks.c (mem2chunk_check, top_check): Handle
	non-contiguous arena.  Reported by Michael Dalton
	<mwdalton@stanford.edu> [BZ #457].  Add further checks for top
	chunk.

Index: malloc/hooks.c
===================================================================
RCS file: /cvs/glibc/libc/malloc/hooks.c,v
retrieving revision 1.15
diff -u -r1.15 hooks.c
--- malloc/hooks.c	9 Sep 2004 21:09:06 -0000	1.15
+++ malloc/hooks.c	19 Oct 2004 16:41:20 -0000
@@ -157,15 +157,16 @@
 
   if(!aligned_OK(mem)) return NULL;
   p = mem2chunk(mem);
-  if( (char*)p>=mp_.sbrk_base &&
-      (char*)p<(mp_.sbrk_base+main_arena.system_mem) ) {
+  if (!chunk_is_mmapped(p)) {
     /* Must be a chunk in conventional heap memory. */
-    if(chunk_is_mmapped(p) ||
-       ( (sz = chunksize(p)),
-	 ((char*)p + sz)>=(mp_.sbrk_base+main_arena.system_mem) ) ||
+    int contig = contiguous(&main_arena);
+    sz = chunksize(p);
+    if((contig &&
+	((char*)p<mp_.sbrk_base ||
+	 ((char*)p + sz)>=(mp_.sbrk_base+main_arena.system_mem) )) ||
        sz<MINSIZE || sz&MALLOC_ALIGN_MASK || !inuse(p) ||
        ( !prev_inuse(p) && (p->prev_size&MALLOC_ALIGN_MASK ||
-                            (long)prev_chunk(p)<(long)mp_.sbrk_base ||
+                            (contig && (char*)prev_chunk(p)<mp_.sbrk_base) ||
                             next_chunk(prev_chunk(p))!=p) ))
       return NULL;
     magic = MAGICBYTE(p);
@@ -213,8 +214,13 @@
   INTERNAL_SIZE_T front_misalign, sbrk_size;
   unsigned long pagesz = malloc_getpagesize;
 
-  if((char*)t + chunksize(t) == mp_.sbrk_base + main_arena.system_mem ||
-     t == initial_top(&main_arena)) return 0;
+  if (t == initial_top(&main_arena) ||
+      (!chunk_is_mmapped(t) &&
+       chunksize(t)>=MINSIZE &&
+       prev_inuse(t) &&
+       (!contiguous(&main_arena) ||
+	(char*)t + chunksize(t) == mp_.sbrk_base + main_arena.system_mem)))
+    return 0;
 
   malloc_printerr (check_action, "malloc: top chunk is corrupt", t);
 


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]