musl - musl - an implementation of the standard library for Linux-based systems

musl - an implementation of the standard library for Linux-based systems

diff options

author	Rich Felker <dalias@aerifal.cx>	2011年08月15日 01:59:15 -0400
committer	Rich Felker <dalias@aerifal.cx>	2011年08月15日 01:59:15 -0400
commit	ce7c6341d38ecd3af4d1e01032e9ea8b4078aa97 (patch)
tree	e7b6fdc92a1a60a85d0c3c45a46224e9782f9acb /src/malloc/malloc.c
parent	6cb277d75e07557dd8442202722d280c1bf93c08 (diff)
download	musl-ce7c6341d38ecd3af4d1e01032e9ea8b4078aa97.tar.gz

simplify and improve double-free check

a valid mmapped block will have an even (actually aligned) "extra" field, whereas a freed chunk on the heap will always have an in-use neighbor. this fixes a potential bug if mmap ever allocated memory below the main program/brk (in which case it would be wrongly-detected as a double-free by the old code) and allows the double-free check to work for donated memory outside of the brk area (or, in the future, secondary heap zones if support for their creation is added).

Diffstat (limited to 'src/malloc/malloc.c')

-rw-r--r--

src/malloc/malloc.c

1 files changed, 2 insertions, 2 deletions

diff --git a/src/malloc/malloc.c b/src/malloc/malloc.c
index db4287ef..0888afa9 100644
--- a/src/malloc/malloc.c
+++ b/src/malloc/malloc.c

@@ -394,7 +394,7 @@ void *realloc(void *p, size_t n)

size_t oldlen = n0 + extra;

size_t newlen = n + extra;

/* Crash on realloc of freed chunk */

- if ((uintptr_t)base < mal.brk) *(volatile char *)0=0;

+ if (extra & 1) *(volatile char *)0=0;

if (newlen < PAGE_SIZE && (new = malloc(n))) {

memcpy(new, p, n-OVERHEAD);

free(p);

@@ -457,7 +457,7 @@ void free(void *p)

char *base = (char *)self - extra;

size_t len = CHUNK_SIZE(self) + extra;

/* Crash on double free */

- if ((uintptr_t)base < mal.brk) *(volatile char *)0=0;

+ if (extra & 1) *(volatile char *)0=0;

__munmap(base, len);

return;

}

generated by cgit v1.2.1 (git 2.18.0) at 2025年09月10日 09:39:57 +0000