GNU C Library master sources branch, master, updated. glibc-2.11-308-g90a3055

[drepper at sourceware dot org]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  90a3055e8bdd9308eceeadc0b37278f324ec6b5d (commit)
       via  991eda1ec17665ea0da247f8eabc6993d020ed8e (commit)
      from  960af486d29fb1c233c5cd92e1d6dc029daeb7af (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
http://sources.redhat.com/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=90a3055e8bdd9308eceeadc0b37278f324ec6b5d

commit 90a3055e8bdd9308eceeadc0b37278f324ec6b5d
Author: Ulrich Drepper <drepper@redhat.com>
Date:   Sat Apr 3 09:47:01 2010 -0700

    One more sanity check in free.

diff --git a/ChangeLog b/ChangeLog
index f61697c..83e6218 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 2010-04-03  Ulrich Drepper  <drepper@redhat.com>
 
+	* malloc/malloc.c (_int_free): Add one more sanity check for fastbins.
+
 	* malloc/malloc.c (set_max_fast): Fix computation of the value.
 
 2010-03-30  David S. Miller  <davem@davemloft.net>
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 784919e..558e8ba 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4852,7 +4852,8 @@ _int_free(mstate av, mchunkptr p)
       free_perturb (chunk2mem(p), size - SIZE_SZ);
 
     set_fastchunks(av);
-    fb = &fastbin (av, fastbin_index(size));
+    unsigned int idx = fastbin_index(size);
+    fb = &fastbin (av, idx);
 
 #ifdef ATOMIC_FASTBINS
     mchunkptr fd;
@@ -4866,6 +4867,12 @@ _int_free(mstate av, mchunkptr p)
 	    errstr = "double free or corruption (fasttop)";
 	    goto errout;
 	  }
+	if (old != NULL
+	    && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
+	  {
+	    errstr = "invalid fastbin entry (free)";
+	    goto errout;
+	  }
 	p->fd = fd = old;
       }
     while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
@@ -4877,6 +4884,12 @@ _int_free(mstate av, mchunkptr p)
 	errstr = "double free or corruption (fasttop)";
 	goto errout;
       }
+    if (*fb != NULL
+	&& __builtin_expect (fastbin_index(chunksize(*fb)) != idx, 0))
+      {
+	errstr = "invalid fastbin entry (free)";
+	goto errout;
+      }
 
     p->fd = *fb;
     *fb = p;

http://sources.redhat.com/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=991eda1ec17665ea0da247f8eabc6993d020ed8e

commit 991eda1ec17665ea0da247f8eabc6993d020ed8e
Author: Ulrich Drepper <drepper@redhat.com>
Date:   Sat Apr 3 09:43:10 2010 -0700

    Fix set_max_fast in malloc.

diff --git a/ChangeLog b/ChangeLog
index dafce4d..f61697c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2010-04-03  Ulrich Drepper  <drepper@redhat.com>
+
+	* malloc/malloc.c (set_max_fast): Fix computation of the value.
+
 2010-03-30  David S. Miller  <davem@davemloft.net>
 
 	* sysdeps/unix/sysv/linux/mmap64.c (__mmap64): Fix
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 6993aea..784919e 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2350,7 +2350,8 @@ typedef struct malloc_chunk* mfastbinptr;
 */
 
 #define set_max_fast(s) \
-  global_max_fast = ((s) == 0)? SMALLBIN_WIDTH: request2size(s)
+  global_max_fast = (((s) == 0)						      \
+		     ? SMALLBIN_WIDTH: ((s + SIZE_SZ) & ~MALLOC_ALIGN_MASK))
 #define get_max_fast() global_max_fast
 
 

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog       |    6 ++++++
 malloc/malloc.c |   18 ++++++++++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
GNU C Library master sources