Blame SOURCES/glibc-rh593396.patch
|
 |
b9ba6d |
2010-05-06 Ulrich Drepper <drepper@redhat.com>
|
|
|
b9ba6d |
|
|
|
b9ba6d |
* malloc/malloc.c (_int_free): Possible race in the most recently
|
|
|
b9ba6d |
added check. Only act on the data if no current modification
|
|
|
b9ba6d |
happened.
|
|
|
b9ba6d |
|
|
|
b9ba6d |
Index: glibc-2.12-2-gc4ccff1/malloc/malloc.c
|
|
|
b9ba6d |
===================================================================
|
|
|
b9ba6d |
--- glibc-2.12-2-gc4ccff1.orig/malloc/malloc.c
|
|
|
b9ba6d |
+++ glibc-2.12-2-gc4ccff1/malloc/malloc.c
|
|
|
b9ba6d |
@@ -4859,6 +4859,7 @@ _int_free(mstate av, mchunkptr p)
|
|
|
b9ba6d |
#ifdef ATOMIC_FASTBINS
|
|
|
b9ba6d |
mchunkptr fd;
|
|
|
b9ba6d |
mchunkptr old = *fb;
|
|
|
b9ba6d |
+ unsigned int old_idx = ~0u;
|
|
|
b9ba6d |
do
|
|
|
b9ba6d |
{
|
|
|
b9ba6d |
/* Another simple check: make sure the top of the bin is not the
|
|
|
b9ba6d |
@@ -4868,15 +4869,17 @@ _int_free(mstate av, mchunkptr p)
|
|
|
b9ba6d |
errstr = "double free or corruption (fasttop)";
|
|
|
b9ba6d |
goto errout;
|
|
|
b9ba6d |
}
|
|
|
b9ba6d |
- if (old != NULL
|
|
|
b9ba6d |
- && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
|
|
|
b9ba6d |
- {
|
|
|
b9ba6d |
- errstr = "invalid fastbin entry (free)";
|
|
|
b9ba6d |
- goto errout;
|
|
|
b9ba6d |
- }
|
|
|
b9ba6d |
+ if (old != NULL)
|
|
|
b9ba6d |
+ old_idx = fastbin_index(chunksize(old));
|
|
|
b9ba6d |
p->fd = fd = old;
|
|
|
b9ba6d |
}
|
|
|
b9ba6d |
while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
|
|
|
b9ba6d |
+
|
|
|
b9ba6d |
+ if (fd != NULL && __builtin_expect (old_idx != idx, 0))
|
|
|
b9ba6d |
+ {
|
|
|
b9ba6d |
+ errstr = "invalid fastbin entry (free)";
|
|
|
b9ba6d |
+ goto errout;
|
|
|
b9ba6d |
+ }
|
|
|
b9ba6d |
#else
|
|
|
b9ba6d |
/* Another simple check: make sure the top of the bin is not the
|
|
|
b9ba6d |
record we are going to add (i.e., double free). */
|