aboutsummaryrefslogtreecommitdiff
path: root/malloc
diff options
context:
space:
mode:
authorFlorian Weimer <fweimer@redhat.com>2016-06-08 20:50:21 +0200
committerFlorian Weimer <fweimer@redhat.com>2016-06-08 20:50:21 +0200
commit1e8a8875d69e36d2890b223ffe8853a8ff0c9512 (patch)
treeeb133b0a58fc24fda5b7093ddd5f259013333256 /malloc
parent8fa8a330f95c2f39eae7960ccf2825e693789202 (diff)
downloadglibc-1e8a8875d69e36d2890b223ffe8853a8ff0c9512.zip
glibc-1e8a8875d69e36d2890b223ffe8853a8ff0c9512.tar.gz
glibc-1e8a8875d69e36d2890b223ffe8853a8ff0c9512.tar.bz2
malloc: Correct size computation in realloc for dumped fake mmapped chunks
For regular mmapped chunks there are two size fields (hence a reduction by 2 * SIZE_SZ bytes), but for fake chunks, we only have one size field, so we need to subtract SIZE_SZ bytes. This was initially reported as Emacs bug 23726.
Diffstat (limited to 'malloc')
-rw-r--r--malloc/malloc.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/malloc/malloc.c b/malloc/malloc.c
index ead9a21..6f77d37 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -1748,7 +1748,9 @@ static struct malloc_state main_arena =
/* These variables are used for undumping support. Chunked are marked
as using mmap, but we leave them alone if they fall into this
- range. */
+ range. NB: The chunk size for these chunks only includes the
+ initial size field (of SIZE_SZ bytes), there is no trailing size
+ field (unlike with regular mmapped chunks). */
static mchunkptr dumped_main_arena_start; /* Inclusive. */
static mchunkptr dumped_main_arena_end; /* Exclusive. */
@@ -3029,9 +3031,11 @@ __libc_realloc (void *oldmem, size_t bytes)
if (newmem == 0)
return NULL;
/* Copy as many bytes as are available from the old chunk
- and fit into the new size. */
- if (bytes > oldsize - 2 * SIZE_SZ)
- bytes = oldsize - 2 * SIZE_SZ;
+ and fit into the new size. NB: The overhead for faked
+ mmapped chunks is only SIZE_SZ, not 2 * SIZE_SZ as for
+ regular mmapped chunks. */
+ if (bytes > oldsize - SIZE_SZ)
+ bytes = oldsize - SIZE_SZ;
memcpy (newmem, oldmem, bytes);
return newmem;
}