]> git.ipfire.org Git - ipfire-2.x.git/blame - src/patches/glibc/glibc-rh593396.patch
lcdproc: Update to 0.5.7
[ipfire-2.x.git] / src / patches / glibc / glibc-rh593396.patch
CommitLineData
12788f63
MT
12010-05-06 Ulrich Drepper <drepper@redhat.com>
2
3 * malloc/malloc.c (_int_free): Possible race in the most recently
4 added check. Only act on the data if no current modification
5 happened.
6
7Index: glibc-2.12-2-gc4ccff1/malloc/malloc.c
8===================================================================
9--- glibc-2.12-2-gc4ccff1.orig/malloc/malloc.c
10+++ glibc-2.12-2-gc4ccff1/malloc/malloc.c
11@@ -4859,6 +4859,7 @@ _int_free(mstate av, mchunkptr p)
12 #ifdef ATOMIC_FASTBINS
13 mchunkptr fd;
14 mchunkptr old = *fb;
15+ unsigned int old_idx = ~0u;
16 do
17 {
18 /* Another simple check: make sure the top of the bin is not the
19@@ -4868,15 +4869,17 @@ _int_free(mstate av, mchunkptr p)
20 errstr = "double free or corruption (fasttop)";
21 goto errout;
22 }
23- if (old != NULL
24- && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
25- {
26- errstr = "invalid fastbin entry (free)";
27- goto errout;
28- }
29+ if (old != NULL)
30+ old_idx = fastbin_index(chunksize(old));
31 p->fd = fd = old;
32 }
33 while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
34+
35+ if (fd != NULL && __builtin_expect (old_idx != idx, 0))
36+ {
37+ errstr = "invalid fastbin entry (free)";
38+ goto errout;
39+ }
40 #else
41 /* Another simple check: make sure the top of the bin is not the
42 record we are going to add (i.e., double free). */