src/patches/glibc/glibc-rh593396.patch

   1 2010-05-06  Ulrich Drepper  <drepper@redhat.com>
   2
   3         * malloc/malloc.c (_int_free): Possible race in the most recently
   4         added check.  Only act on the data if no current modification
   5         happened.
   6
   7 Index: glibc-2.12-2-gc4ccff1/malloc/malloc.c
   8 ===================================================================
   9 --- glibc-2.12-2-gc4ccff1.orig/malloc/malloc.c
  10 +++ glibc-2.12-2-gc4ccff1/malloc/malloc.c
  11 @@ -4859,6 +4859,7 @@ _int_free(mstate av, mchunkptr p)
  12  #ifdef ATOMIC_FASTBINS
  13      mchunkptr fd;
  14      mchunkptr old = *fb;
  15 +    unsigned int old_idx = ~0u;
  16      do
  17        {
  18         /* Another simple check: make sure the top of the bin is not the
  19 @@ -4868,15 +4869,17 @@ _int_free(mstate av, mchunkptr p)
  20             errstr = "double free or corruption (fasttop)";
  21             goto errout;
  22           }
  23 -       if (old != NULL
  24 -           && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
  25 -         {
  26 -           errstr = "invalid fastbin entry (free)";
  27 -           goto errout;
  28 -         }
  29 +       if (old != NULL)
  30 +         old_idx = fastbin_index(chunksize(old));
  31         p->fd = fd = old;
  32        }
  33      while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
  34 +
  35 +    if (fd != NULL && __builtin_expect (old_idx != idx, 0))
  36 +      {
  37 +       errstr = "invalid fastbin entry (free)";
  38 +       goto errout;
  39 +      }
  40  #else
  41      /* Another simple check: make sure the top of the bin is not the
  42         record we are going to add (i.e., double free).  */