8ae002
commit 52ffbdf25a1100986f4ae27bb0febbe5a722ab25
8ae002
Author: Florian Weimer <fweimer@redhat.com>
8ae002
Date:   Wed Sep 10 20:29:15 2014 +0200
8ae002
8ae002
    malloc: additional unlink hardening for non-small bins [BZ #17344]
8ae002
    
8ae002
    Turn two asserts into a conditional call to malloc_printerr.  The
8ae002
    memory locations are accessed later anyway, so the performance
8ae002
    impact is minor.
8ae002
8ae002
Index: b/malloc/malloc.c
8ae002
===================================================================
8ae002
--- a/malloc/malloc.c
8ae002
+++ b/malloc/malloc.c
8ae002
@@ -1441,8 +1441,11 @@ typedef struct malloc_chunk* mbinptr;
8ae002
     BK->fd = FD;                                                       \
8ae002
     if (!in_smallbin_range (P->size)				       \
8ae002
 	&& __builtin_expect (P->fd_nextsize != NULL, 0)) {	       \
8ae002
-      assert (P->fd_nextsize->bk_nextsize == P);		       \
8ae002
-      assert (P->bk_nextsize->fd_nextsize == P);		       \
8ae002
+      if (__builtin_expect (P->fd_nextsize->bk_nextsize != P, 0)       \
8ae002
+	  || __builtin_expect (P->bk_nextsize->fd_nextsize != P, 0))   \
8ae002
+	malloc_printerr (check_action,				       \
8ae002
+			 "corrupted double-linked list (not small)", P,\
8ae002
+			 AV);					       \
8ae002
       if (FD->fd_nextsize == NULL) {				       \
8ae002
 	if (P->fd_nextsize == P)				       \
8ae002
 	  FD->fd_nextsize = FD->bk_nextsize = FD;		       \