This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
[RFC][PATCH 3/7] malloc: Ensure that the consolidated fast chunk has a sane size.
- From: Istvan Kurucsai <pistukem at gmail dot com>
- To: libc-alpha at sourceware dot org
- Cc: Istvan Kurucsai <pistukem at gmail dot com>
- Date: Wed, 31 May 2017 10:43:51 +0200
- Subject: [RFC][PATCH 3/7] malloc: Ensure that the consolidated fast chunk has a sane size.
- Authentication-results: sourceware.org; auth=none
- References: <1496220235-12750-1-git-send-email-pistukem@gmail.com>
* malloc/malloc.c (malloc_consolidate): Add size check.
---
malloc/malloc.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 34310a2..873aa29 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4165,6 +4165,7 @@ static void malloc_consolidate(mstate av)
mfastbinptr* fb; /* current fastbin being consolidated */
mfastbinptr* maxfb; /* last fastbin (for loop control) */
mchunkptr p; /* current chunk being consolidated */
+ unsigned int idx; /* fastbin index of current chunk */
mchunkptr nextp; /* next chunk to consolidate */
mchunkptr unsorted_bin; /* bin header */
mchunkptr first_unsorted; /* chunk to link to */
@@ -4202,6 +4203,14 @@ static void malloc_consolidate(mstate av)
p = atomic_exchange_acq (fb, NULL);
if (p != 0) {
do {
+ idx = fastbin_index (chunksize (p));
+ if ((&fastbin (av, idx)) != fb) {
+ malloc_printerr (check_action,
+ "malloc_consolidate(): invalid chunk size",
+ chunk2mem(p), av);
+ return;
+ }
+
check_inuse_chunk(av, p);
nextp = p->fd;
--
2.7.4