projects / ipfire-2.x.git / blame
| Commit | Line | Data |
|---|---|---|
| 12788f63 MT |
1 | 2010-05-06 Ulrich Drepper <drepper@redhat.com> |
| 2 | ||
| 3 | * malloc/malloc.c (_int_free): Possible race in the most recently | |
| 4 | added check. Only act on the data if no current modification | |
| 5 | happened. | |
| 6 | ||
| 7 | Index: glibc-2.12-2-gc4ccff1/malloc/malloc.c | |
| 8 | =================================================================== | |
| 9 | --- glibc-2.12-2-gc4ccff1.orig/malloc/malloc.c | |
| 10 | +++ glibc-2.12-2-gc4ccff1/malloc/malloc.c | |
| 11 | @@ -4859,6 +4859,7 @@ _int_free(mstate av, mchunkptr p) | |
| 12 | #ifdef ATOMIC_FASTBINS | |
| 13 | mchunkptr fd; | |
| 14 | mchunkptr old = *fb; | |
| 15 | + unsigned int old_idx = ~0u; | |
| 16 | do | |
| 17 | { | |
| 18 | /* Another simple check: make sure the top of the bin is not the | |
| 19 | @@ -4868,15 +4869,17 @@ _int_free(mstate av, mchunkptr p) | |
| 20 | errstr = "double free or corruption (fasttop)"; | |
| 21 | goto errout; | |
| 22 | } | |
| 23 | - if (old != NULL | |
| 24 | - && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0)) | |
| 25 | - { | |
| 26 | - errstr = "invalid fastbin entry (free)"; | |
| 27 | - goto errout; | |
| 28 | - } | |
| 29 | + if (old != NULL) | |
| 30 | + old_idx = fastbin_index(chunksize(old)); | |
| 31 | p->fd = fd = old; | |
| 32 | } | |
| 33 | while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd); | |
| 34 | + | |
| 35 | + if (fd != NULL && __builtin_expect (old_idx != idx, 0)) | |
| 36 | + { | |
| 37 | + errstr = "invalid fastbin entry (free)"; | |
| 38 | + goto errout; | |
| 39 | + } | |
| 40 | #else | |
| 41 | /* Another simple check: make sure the top of the bin is not the | |
| 42 | record we are going to add (i.e., double free). */ |