]>
Commit | Line | Data |
---|---|---|
7c9a7c68 | 1 | /* Test that malloc tcache catches double free. |
04277e02 | 2 | Copyright (C) 2018-2019 Free Software Foundation, Inc. |
7c9a7c68 DD |
3 | This file is part of the GNU C Library. |
4 | ||
5 | The GNU C Library is free software; you can redistribute it and/or | |
6 | modify it under the terms of the GNU Lesser General Public | |
7 | License as published by the Free Software Foundation; either | |
8 | version 2.1 of the License, or (at your option) any later version. | |
9 | ||
10 | The GNU C Library is distributed in the hope that it will be useful, | |
11 | but WITHOUT ANY WARRANTY; without even the implied warranty of | |
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
13 | Lesser General Public License for more details. | |
14 | ||
15 | You should have received a copy of the GNU Lesser General Public | |
16 | License along with the GNU C Library; if not, see | |
17 | <http://www.gnu.org/licenses/>. */ | |
18 | ||
19 | #include <malloc.h> | |
20 | #include <string.h> | |
21 | ||
22 | /* Prevent GCC from optimizing away any malloc/free pairs. */ | |
23 | #pragma GCC optimize ("O0") | |
24 | ||
25 | static int | |
26 | do_test (void) | |
27 | { | |
28 | /* Do two allocation of any size that fit in tcache, and one that | |
29 | doesn't. */ | |
30 | int ** volatile a = malloc (32); | |
31 | int ** volatile b = malloc (32); | |
32 | /* This is just under the mmap threshold. */ | |
33 | int ** volatile c = malloc (127 * 1024); | |
34 | ||
35 | /* The invalid "tcache bucket" we might dereference will likely end | |
36 | up somewhere within this memory block, so make all the accidental | |
37 | "next" pointers cause segfaults. BZ #23907. */ | |
38 | memset (c, 0xff, 127 * 1024); | |
39 | ||
40 | free (a); // puts in tcache | |
41 | ||
42 | /* A is now free and contains the key we use to detect in-tcache. | |
43 | Copy the key to the other chunks. */ | |
44 | memcpy (b, a, 32); | |
45 | memcpy (c, a, 32); | |
46 | ||
47 | /* This free tests the "are we in the tcache already" loop with a | |
48 | VALID bin but "coincidental" matching key. */ | |
49 | free (b); // should NOT abort | |
50 | /* This free tests the "is it a valid tcache bin" test. */ | |
51 | free (c); // should NOT abort | |
52 | ||
53 | return 0; | |
54 | } | |
55 | ||
56 | #include <support/test-driver.c> |