From: Ulrich Drepper <drepper@redhat.com>
Date: Fri, 26 Mar 2010 02:45:20 +0000 (-0700)
Subject: Merge branch 'master' of ssh://sources.redhat.com/git/glibc
X-Git-Tag: fedora/glibc-2.11.90-17~2^2~46
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=70c90289ff7e2f1ca976618bcf342d9c65c746fc;p=thirdparty%2Fglibc.git

Merge branch 'master' of ssh://sources.redhat.com/git/glibc

Conflicts:
	ChangeLog
---

70c90289ff7e2f1ca976618bcf342d9c65c746fc
diff --cc ChangeLog
index 6029367106b,13f07495d08..3845cafc253
--- a/ChangeLog
+++ b/ChangeLog
@@@ -1,16 -1,9 +1,20 @@@
 +2010-03-24  Ulrich Drepper  <drepper@redhat.com>
 +
 +	[BZ #11389]
 +	* bits/time.h: Define CLOCK_MONOTONIC_RAW, CLOCK_REALTIME_COARSE, and
 +	CLOCK_MONOTONIC_COARSE.
 +	* sysdeps/unix/sysv/linux/clock_getres.c: Handle CLOCK_MONOTONIC_RAW,
 +	CLOCK_REALTIME_COARSE, and CLOCK_MONOTONIC_COARSE.
 +	* sysdeps/unix/sysv/linux/clock_gettime.c: Likewise.
 +	* sysdeps/unix/sysv/linux/clock_settime.c: Likewise.
 +
+ 2010-03-25  Andreas Schwab  <schwab@redhat.com>
+ 
+ 	* sysdeps/posix/cuserid.c: Fix typo.
+ 
  2010-03-16  Chris Demetriou  <cgd@google.com>
  
 +	[BZ #11394]
  	* locale/programs/simple-hash.c: Include inttypes.h.
  	(hashval_t): Defined to be uint32_t.
  	* locale/programs/simple_hash.h: Include inttypes.h.
diff --cc malloc/malloc.c
index 763852ea3b7,763852ea3b7..0004c878f37
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@@ -4852,7 -4852,7 +4852,8 @@@ _int_free(mstate av, mchunkptr p
        free_perturb (chunk2mem(p), size - SIZE_SZ);
  
      set_fastchunks(av);
--    fb = &fastbin (av, fastbin_index(size));
++    unsigned int idx = fastbin_index(size);
++    fb = &fastbin (av, idx);
  
  #ifdef ATOMIC_FASTBINS
      mchunkptr fd;
@@@ -4866,6 -4866,6 +4867,12 @@@
  	    errstr = "double free or corruption (fasttop)";
  	    goto errout;
  	  }
++	if (old != NULL
++	    && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
++	  {
++	    errstr = "invalid fastbin entry (free)";
++	    goto errout;
++	  }
  	p->fd = fd = old;
        }
      while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
@@@ -4877,6 -4877,6 +4884,12 @@@
  	errstr = "double free or corruption (fasttop)";
  	goto errout;
        }
++    if (*fb != NULL
++	&& __builtin_expect (fastbin_index(chunksize(*fb)) != idx, 0))
++      {
++	errstr = "invalid fastbin entry (free)";
++	goto errout;
++      }
  
      p->fd = *fb;
      *fb = p;
diff --cc malloc/tst-mallocstate.c
index 97a10586d36,97a10586d36..2a1fd469abc
--- a/malloc/tst-mallocstate.c
+++ b/malloc/tst-mallocstate.c
@@@ -51,6 -51,6 +51,7 @@@ main (void
  
    for (i=0; i<100; ++i)
      {
++printf("round %li\n", i);
        save_state = malloc_get_state ();
        if (save_state == NULL)
  	{
@@@ -64,13 -64,13 +65,18 @@@
  	merror ("realloc (i*4) failed.");
        free (save_state);
      }
++puts("done");
  
    p1 = realloc (p1, 40);
++puts("after realloc");
    free (p2);
++puts("after free 1");
    p2 = malloc (10);
++puts("after malloc");
    if (p2 == NULL)
      merror ("malloc (10) failed.");
    free (p1);
++puts("after free 2");
  
    return errors != 0;
  }