This is the mail archive of the libc-alpha@sourceware.org mailing list for the glibc project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[RFC][PATCH 3/7] malloc: Ensure that the consolidated fast chunk has a sane size.


    * malloc/malloc.c (malloc_consolidate): Add size check.
---
 malloc/malloc.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 34310a2..873aa29 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4165,6 +4165,7 @@ static void malloc_consolidate(mstate av)
   mfastbinptr*    fb;                 /* current fastbin being consolidated */
   mfastbinptr*    maxfb;              /* last fastbin (for loop control) */
   mchunkptr       p;                  /* current chunk being consolidated */
+  unsigned int    idx;                /* fastbin index of current chunk */
   mchunkptr       nextp;              /* next chunk to consolidate */
   mchunkptr       unsorted_bin;       /* bin header */
   mchunkptr       first_unsorted;     /* chunk to link to */
@@ -4202,6 +4203,14 @@ static void malloc_consolidate(mstate av)
       p = atomic_exchange_acq (fb, NULL);
       if (p != 0) {
 	do {
+	  idx = fastbin_index (chunksize (p));
+	  if ((&fastbin (av, idx)) != fb) {
+	    malloc_printerr (check_action, 
+			     "malloc_consolidate(): invalid chunk size",
+			     chunk2mem(p), av);
+	    return;
+	  }
+
 	  check_inuse_chunk(av, p);
 	  nextp = p->fd;
 
-- 
2.7.4


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]