Fix perturbing in malloc on free.

(cherry picked from commit fdc0f374bcd2d0513569aa8d600f960e43e8af1d)

diff --git a/ChangeLog b/ChangeLog
index a69022e7463555af5ca86434b2f678386458a9c8..b097f0bc389a491cde55908cb2d30d4d3c692957 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-10-24  Ulrich Drepper  <drepper@redhat.com>
+
+       [BZ #12140]
+       * malloc/malloc.c (_int_free): Fill correct number of bytes when
+       perturbing.
+
 2010-09-09  Andreas Schwab  <schwab@redhat.com>
 
        * Makeconfig (sysd-rules-patterns): Add rtld-%:rtld-%.

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 9594be4cbde8e48662123864c7b34f18503a7031..b492c0a3fd132818a0705090c3c56801730decbc 100644 (file)
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4850,7 +4850,7 @@ _int_free(mstate av, mchunkptr p)
       }
 
     if (__builtin_expect (perturb_byte, 0))
-      free_perturb (chunk2mem(p), size - SIZE_SZ);
+      free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
 
     set_fastchunks(av);
     unsigned int idx = fastbin_index(size);
@@ -4954,7 +4954,7 @@ _int_free(mstate av, mchunkptr p)
       }
 
     if (__builtin_expect (perturb_byte, 0))
-      free_perturb (chunk2mem(p), size - SIZE_SZ);
+      free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
 
     /* consolidate backward */
     if (!prev_inuse(p)) {