[PATCH] [v2] malloc: Do not corrupt the top of a threaded heap if top chunk is MINSIZE [BZ #18502]

[Andreas Schwab]

Mel Gorman <mgorman@suse.de> writes:

> diff --git a/malloc/arena.c b/malloc/arena.c
> index 2466697d1aa7..b932574ccaf8 100644
> --- a/malloc/arena.c
> +++ b/malloc/arena.c
> @@ -698,6 +698,9 @@ heap_trim (heap_info *heap, size_t pad)
>    /* Uses similar logic for per-thread arenas as the main arena with systrim
>       by preserving the top pad and at least a page.  */
>    top_size = chunksize (top_chunk);
> +  if (top_size == MINSIZE)
> +    return 0;
> +
>    top_area = top_size - MINSIZE - 1;
>    if (top_area <= pad)
>      return 0;
>

For rebustness I'd check for top_area < 0 instead.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."