Another version of the free checks.

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 323ad84663a8fac6649fc59e60eef8830ca99688..ca7c7e59bc939e31ddd8dd7266d753ca7599b664 100644 (file)
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4233,7 +4233,7 @@ _int_free(mstate av, Void_t* mem)
 #endif
       ) {
 
-    if (__builtin_expect (chunksize (chunk_at_offset (p, size)) < 2 * SIZE_SZ,
+    if (__builtin_expect (chunksize (chunk_at_offset (p, size)) <= 2 * SIZE_SZ,
                          0)
        || __builtin_expect (chunksize (chunk_at_offset (p, size))
                             >= av->system_mem, 0))
@@ -4285,7 +4285,12 @@ _int_free(mstate av, Void_t* mem)
       }
 
     nextsize = chunksize(nextchunk);
-    assert(nextsize > 0);
+    if (__builtin_expect (nextsize <= 2 * SIZE_SZ, 0)
+       || __builtin_expect (nextsize >= av->system_mem, 0))
+      {
+       errstr = "invalid next size (normal)";
+       goto errout;
+      }
 
     /* consolidate backward */
     if (!prev_inuse(p)) {