src/patches/glibc/glibc-rh1256812-3.patch

   1 commit fdc0f374bcd2d0513569aa8d600f960e43e8af1d
   2 Author: Ulrich Drepper <drepper@redhat.com>
   3 Date:   Sun Oct 24 22:37:00 2010 -0400
   4
   5     Fix perturbing in malloc on free.
   6
   7 commit e8349efd466cfedc0aa98be61d88ca8795c9e565
   8 Author: Ondřej Bílka <neleai@seznam.cz>
   9 Date:   Mon Dec 9 17:25:19 2013 +0100
  10
  11     Simplify perturb_byte logic.
  12
  13 diff --git a/malloc/malloc.c b/malloc/malloc.c
  14 index 4821deb..ac8c3f6 100644
  15 --- a/malloc/malloc.c
  16 +++ b/malloc/malloc.c
  17 @@ -1870,8 +1870,20 @@ static int check_action = DEFAULT_CHECK_ACTION;
  18
  19  static int perturb_byte;
  20
  21 -#define alloc_perturb(p, n) memset (p, (perturb_byte ^ 0xff) & 0xff, n)
  22 -#define free_perturb(p, n) memset (p, perturb_byte & 0xff, n)
  23 +static inline void
  24 +alloc_perturb (char *p, size_t n)
  25 +{
  26 +  if (__glibc_unlikely (perturb_byte))
  27 +    memset (p, perturb_byte ^ 0xff, n);
  28 +}
  29 +
  30 +static inline void
  31 +free_perturb (char *p, size_t n)
  32 +{
  33 +  if (__glibc_unlikely (perturb_byte))
  34 +    memset (p, perturb_byte, n);
  35 +}
  36 +
  37
  38
  39  /* ------------------- Support for multiple arenas -------------------- */
  40 @@ -3287,8 +3299,7 @@ _int_malloc(mstate av, size_t bytes)
  41  #endif
  42        check_remalloced_chunk(av, victim, nb);
  43        void *p = chunk2mem(victim);
  44 -      if (__builtin_expect (perturb_byte, 0))
  45 -       alloc_perturb (p, bytes);
  46 +      alloc_perturb (p, bytes);
  47        return p;
  48      }
  49    }
  50 @@ -3323,8 +3334,7 @@ _int_malloc(mstate av, size_t bytes)
  51           victim->size |= NON_MAIN_ARENA;
  52         check_malloced_chunk(av, victim, nb);
  53         void *p = chunk2mem(victim);
  54 -       if (__builtin_expect (perturb_byte, 0))
  55 -         alloc_perturb (p, bytes);
  56 +       alloc_perturb (p, bytes);
  57         return p;
  58        }
  59      }
  60 @@ -3403,8 +3413,7 @@ _int_malloc(mstate av, size_t bytes)
  61
  62         check_malloced_chunk(av, victim, nb);
  63         void *p = chunk2mem(victim);
  64 -       if (__builtin_expect (perturb_byte, 0))
  65 -         alloc_perturb (p, bytes);
  66 +       alloc_perturb (p, bytes);
  67         return p;
  68        }
  69
  70 @@ -3420,8 +3429,7 @@ _int_malloc(mstate av, size_t bytes)
  71           victim->size |= NON_MAIN_ARENA;
  72         check_malloced_chunk(av, victim, nb);
  73         void *p = chunk2mem(victim);
  74 -       if (__builtin_expect (perturb_byte, 0))
  75 -         alloc_perturb (p, bytes);
  76 +       alloc_perturb (p, bytes);
  77         return p;
  78        }
  79
  80 @@ -3545,8 +3553,7 @@ _int_malloc(mstate av, size_t bytes)
  81         }
  82         check_malloced_chunk(av, victim, nb);
  83         void *p = chunk2mem(victim);
  84 -       if (__builtin_expect (perturb_byte, 0))
  85 -         alloc_perturb (p, bytes);
  86 +       alloc_perturb (p, bytes);
  87         return p;
  88        }
  89      }
  90 @@ -3649,8 +3656,7 @@ _int_malloc(mstate av, size_t bytes)
  91         }
  92         check_malloced_chunk(av, victim, nb);
  93         void *p = chunk2mem(victim);
  94 -       if (__builtin_expect (perturb_byte, 0))
  95 -         alloc_perturb (p, bytes);
  96 +       alloc_perturb (p, bytes);
  97         return p;
  98        }
  99      }
 100 @@ -3684,8 +3690,7 @@ _int_malloc(mstate av, size_t bytes)
 101
 102        check_malloced_chunk(av, victim, nb);
 103        void *p = chunk2mem(victim);
 104 -      if (__builtin_expect (perturb_byte, 0))
 105 -       alloc_perturb (p, bytes);
 106 +      alloc_perturb (p, bytes);
 107        return p;
 108      }
 109
 110 @@ -3705,7 +3710,7 @@ _int_malloc(mstate av, size_t bytes)
 111      */
 112      else {
 113        void *p = sYSMALLOc(nb, av);
 114 -      if (p != NULL && __builtin_expect (perturb_byte, 0))
 115 +      if (p != NULL)
 116         alloc_perturb (p, bytes);
 117        return p;
 118      }
 119 @@ -3798,8 +3803,7 @@ _int_free(mstate av, mchunkptr p, int have_lock)
 120  #endif
 121        }
 122
 123 -    if (__builtin_expect (perturb_byte, 0))
 124 -      free_perturb (chunk2mem(p), size - SIZE_SZ);
 125 +    free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
 126
 127      set_fastchunks(av);
 128      unsigned int idx = fastbin_index(size);
 129 @@ -3881,8 +3885,7 @@ _int_free(mstate av, mchunkptr p, int have_lock)
 130         goto errout;
 131        }
 132
 133 -    if (__builtin_expect (perturb_byte, 0))
 134 -      free_perturb (chunk2mem(p), size - SIZE_SZ);
 135 +    free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
 136
 137      /* consolidate backward */
 138      if (!prev_inuse(p)) {