]>
Commit | Line | Data |
---|---|---|
12788f63 MT |
1 | 2010-05-06 Ulrich Drepper <drepper@redhat.com> |
2 | ||
3 | * malloc/malloc.c (_int_free): Possible race in the most recently | |
4 | added check. Only act on the data if no current modification | |
5 | happened. | |
6 | ||
7 | Index: glibc-2.12-2-gc4ccff1/malloc/malloc.c | |
8 | =================================================================== | |
9 | --- glibc-2.12-2-gc4ccff1.orig/malloc/malloc.c | |
10 | +++ glibc-2.12-2-gc4ccff1/malloc/malloc.c | |
11 | @@ -4859,6 +4859,7 @@ _int_free(mstate av, mchunkptr p) | |
12 | #ifdef ATOMIC_FASTBINS | |
13 | mchunkptr fd; | |
14 | mchunkptr old = *fb; | |
15 | + unsigned int old_idx = ~0u; | |
16 | do | |
17 | { | |
18 | /* Another simple check: make sure the top of the bin is not the | |
19 | @@ -4868,15 +4869,17 @@ _int_free(mstate av, mchunkptr p) | |
20 | errstr = "double free or corruption (fasttop)"; | |
21 | goto errout; | |
22 | } | |
23 | - if (old != NULL | |
24 | - && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0)) | |
25 | - { | |
26 | - errstr = "invalid fastbin entry (free)"; | |
27 | - goto errout; | |
28 | - } | |
29 | + if (old != NULL) | |
30 | + old_idx = fastbin_index(chunksize(old)); | |
31 | p->fd = fd = old; | |
32 | } | |
33 | while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd); | |
34 | + | |
35 | + if (fd != NULL && __builtin_expect (old_idx != idx, 0)) | |
36 | + { | |
37 | + errstr = "invalid fastbin entry (free)"; | |
38 | + goto errout; | |
39 | + } | |
40 | #else | |
41 | /* Another simple check: make sure the top of the bin is not the | |
42 | record we are going to add (i.e., double free). */ |