From: Jakub Jelinek <jakub@redhat.com>
Date: Fri, 19 Nov 2004 00:20:40 +0000 (+0000)
Subject: Another version of the free checks.
X-Git-Tag: cvs/fedora-glibc-2_3_3-80~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5a312412f24a282cb24e762a33916484402c374b;p=thirdparty%2Fglibc.git

Another version of the free checks.
---

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 323ad84663a..ca7c7e59bc9 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4233,7 +4233,7 @@ _int_free(mstate av, Void_t* mem)
 #endif
       ) {
 
-    if (__builtin_expect (chunksize (chunk_at_offset (p, size)) < 2 * SIZE_SZ,
+    if (__builtin_expect (chunksize (chunk_at_offset (p, size)) <= 2 * SIZE_SZ,
 			  0)
 	|| __builtin_expect (chunksize (chunk_at_offset (p, size))
 			     >= av->system_mem, 0))
@@ -4285,7 +4285,12 @@ _int_free(mstate av, Void_t* mem)
       }
 
     nextsize = chunksize(nextchunk);
-    assert(nextsize > 0);
+    if (__builtin_expect (nextsize <= 2 * SIZE_SZ, 0)
+	|| __builtin_expect (nextsize >= av->system_mem, 0))
+      {
+	errstr = "invalid next size (normal)";
+	goto errout;
+      }
 
     /* consolidate backward */
     if (!prev_inuse(p)) {