Fix perturbing in malloc on free.

(cherry picked from commit fdc0f374bcd2d0513569aa8d600f960e43e8af1d)

diff --git a/ChangeLog b/ChangeLog
index b9b347ad080fd596535fe2a7d291020763294ac5..a95b1821ce4bdeaad3c7ce1bd4d52093180706b3 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-10-24  Ulrich Drepper  <drepper@redhat.com>
+
+       [BZ #12140]
+       * malloc/malloc.c (_int_free): Fill correct number of bytes when
+       perturbing.
+
 2010-09-09  Andreas Schwab  <schwab@redhat.com>
 
        * Makeconfig (sysd-rules-patterns): Add rtld-%:rtld-%.

diff --git a/malloc/malloc.c b/malloc/malloc.c
index b1d43c6447c278ac4a49e2f4eca92084b027c352..29c79923d134362f0adf7cce4f21fcd552aa9c29 100644 (file)
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4850,7 +4850,7 @@ _int_free(mstate av, mchunkptr p)
       }
 
     if (__builtin_expect (perturb_byte, 0))
-      free_perturb (chunk2mem(p), size - SIZE_SZ);
+      free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
 
     set_fastchunks(av);
     fb = &fastbin (av, fastbin_index(size));
@@ -4938,7 +4938,7 @@ _int_free(mstate av, mchunkptr p)
       }
 
     if (__builtin_expect (perturb_byte, 0))
-      free_perturb (chunk2mem(p), size - SIZE_SZ);
+      free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
 
     /* consolidate backward */
     if (!prev_inuse(p)) {