Skip to content

Commit

Permalink
[BZ #457]
Browse files Browse the repository at this point in the history
Update.
2004-10-19  Wolfram Gloger  <wg@malloc.de>

	* malloc/hooks.c (mem2chunk_check, top_check): Handle
	non-contiguous arena.  Reported by Michael Dalton
	<mwdalton@stanford.edu> [BZ #457].  Add further checks for top chunk.
  • Loading branch information
Ulrich Drepper committed Dec 14, 2004
1 parent 1f7d969 commit b102cfc
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 8 deletions.
6 changes: 6 additions & 0 deletions ChangeLog
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
2004-10-19 Wolfram Gloger <wg@malloc.de>

* malloc/hooks.c (mem2chunk_check, top_check): Handle
non-contiguous arena. Reported by Michael Dalton
<mwdalton@stanford.edu> [BZ #457]. Add further checks for top chunk.

2004-12-14 Jakub Jelinek <jakub@redhat.com>

* sysdeps/posix/sysconf.c (__sysconf_check_spec): Remove leading
Expand Down
22 changes: 14 additions & 8 deletions malloc/hooks.c
Original file line number Diff line number Diff line change
Expand Up @@ -157,15 +157,16 @@ mem2chunk_check(mem) Void_t* mem;

if(!aligned_OK(mem)) return NULL;
p = mem2chunk(mem);
if( (char*)p>=mp_.sbrk_base &&
(char*)p<(mp_.sbrk_base+main_arena.system_mem) ) {
if (!chunk_is_mmapped(p)) {
/* Must be a chunk in conventional heap memory. */
if(chunk_is_mmapped(p) ||
( (sz = chunksize(p)),
((char*)p + sz)>=(mp_.sbrk_base+main_arena.system_mem) ) ||
int contig = contiguous(&main_arena);
sz = chunksize(p);
if((contig &&
((char*)p<mp_.sbrk_base ||
((char*)p + sz)>=(mp_.sbrk_base+main_arena.system_mem) )) ||
sz<MINSIZE || sz&MALLOC_ALIGN_MASK || !inuse(p) ||
( !prev_inuse(p) && (p->prev_size&MALLOC_ALIGN_MASK ||
(long)prev_chunk(p)<(long)mp_.sbrk_base ||
(contig && (char*)prev_chunk(p)<mp_.sbrk_base) ||
next_chunk(prev_chunk(p))!=p) ))
return NULL;
magic = MAGICBYTE(p);
Expand Down Expand Up @@ -213,8 +214,13 @@ top_check()
INTERNAL_SIZE_T front_misalign, sbrk_size;
unsigned long pagesz = malloc_getpagesize;

if((char*)t + chunksize(t) == mp_.sbrk_base + main_arena.system_mem ||
t == initial_top(&main_arena)) return 0;
if (t == initial_top(&main_arena) ||
(!chunk_is_mmapped(t) &&
chunksize(t)>=MINSIZE &&
prev_inuse(t) &&
(!contiguous(&main_arena) ||
(char*)t + chunksize(t) == mp_.sbrk_base + main_arena.system_mem)))
return 0;

malloc_printerr (check_action, "malloc: top chunk is corrupt", t);

Expand Down

0 comments on commit b102cfc

Please sign in to comment.