diff options
| author | Otto Moerbeek <otto@cvs.openbsd.org> | 2016-11-03 18:52:41 +0000 |
|---|---|---|
| committer | Otto Moerbeek <otto@cvs.openbsd.org> | 2016-11-03 18:52:41 +0000 |
| commit | db0143943b8f507d71ab8382ccb3d557bb2b28f4 (patch) | |
| tree | 33ea1c6c4205bdca7563de95c57ba160cb834847 | |
| parent | 290031f9d547e986401ab390cba2229281c48b80 (diff) | |
small tweak to also check canaries if F is in effect
| -rw-r--r-- | lib/libc/stdlib/malloc.c | 8 | ||||
| -rw-r--r-- | libexec/ld.so/malloc.c | 6 |
2 files changed, 9 insertions, 5 deletions
diff --git a/lib/libc/stdlib/malloc.c b/lib/libc/stdlib/malloc.c index 62e5fe24694..873db60dd5c 100644 --- a/lib/libc/stdlib/malloc.c +++ b/lib/libc/stdlib/malloc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: malloc.c,v 1.209 2016/10/31 10:06:56 otto Exp $ */ +/* $OpenBSD: malloc.c,v 1.210 2016/11/03 18:51:49 otto Exp $ */ /* * Copyright (c) 2008, 2010, 2011, 2016 Otto Moerbeek <otto@drijf.net> * Copyright (c) 2012 Matthew Dempsky <matthew@openbsd.org> @@ -1039,7 +1039,7 @@ find_chunknum(struct dir_info *d, struct region_info *r, void *ptr, int check) /* Find the chunk number on the page */ chunknum = ((uintptr_t)ptr & MALLOC_PAGEMASK) >> info->shift; - if (check && mopts.chunk_canaries && info->size > 0) { + if (check && info->size > 0) { validate_canary(d, ptr, info->bits[info->offset + chunknum], info->size); } @@ -1343,8 +1343,10 @@ ofree(struct dir_info *argpool, void *p) void *tmp; int i; + /* Delayed free or canaries? Extra check */ + if (!mopts.malloc_freenow || mopts.chunk_canaries) + find_chunknum(pool, r, p, mopts.chunk_canaries); if (!mopts.malloc_freenow) { - find_chunknum(pool, r, p, 1); if (mopts.malloc_junk && sz > 0) memset(p, SOME_FREEJUNK, sz); i = getrbyte(pool) & MALLOC_DELAYED_CHUNK_MASK; diff --git a/libexec/ld.so/malloc.c b/libexec/ld.so/malloc.c index cf48becfce7..1c2cc6c0b44 100644 --- a/libexec/ld.so/malloc.c +++ b/libexec/ld.so/malloc.c @@ -760,7 +760,7 @@ find_chunknum(struct dir_info *d, struct region_info *r, void *ptr, int check) /* Find the chunk number on the page */ chunknum = ((uintptr_t)ptr & MALLOC_PAGEMASK) >> info->shift; - if (check && mopts.chunk_canaries && info->size > 0) { + if (check && info->size > 0) { validate_canary(d, ptr, info->bits[info->offset + chunknum], info->size); } @@ -989,8 +989,10 @@ ofree(void *p) void *tmp; int i; + /* Delayed free or canaries? Extra check! */ + if (!mopts.malloc_freenow || mopts.chunk_canaries) + find_chunknum(g_pool, r, p, mopts.chunk_canaries); if (!mopts.malloc_freenow) { - find_chunknum(g_pool, r, p, 1); if (mopts.malloc_junk && sz > 0) _dl_memset(p, SOME_FREEJUNK, sz); i = getrbyte(g_pool) & MALLOC_DELAYED_CHUNK_MASK; |