diff options
| author | Otto Moerbeek <otto@cvs.openbsd.org> | 2012-12-22 07:32:18 +0000 |
|---|---|---|
| committer | Otto Moerbeek <otto@cvs.openbsd.org> | 2012-12-22 07:32:18 +0000 |
| commit | 9d3d23ac4e94a6a61f1681050c5054a3c0e90acf (patch) | |
| tree | 36bedfff72cb28168532d24d88e752c8ed7b82d1 /lib | |
| parent | 7939591a92d4a22100cb53e2f419505e106d478c (diff) | |
Fix bug in random offset introduced in rev 1.143; random range was
expanded, but not enough due to precedence error. Spotted by Thorsten Glaser.
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libc/stdlib/malloc.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/libc/stdlib/malloc.c b/lib/libc/stdlib/malloc.c index b14c7476524..af175875520 100644 --- a/lib/libc/stdlib/malloc.c +++ b/lib/libc/stdlib/malloc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: malloc.c,v 1.148 2012/11/02 18:18:15 djm Exp $ */ +/* $OpenBSD: malloc.c,v 1.149 2012/12/22 07:32:17 otto Exp $ */ /* * Copyright (c) 2008 Otto Moerbeek <otto@drijf.net> * @@ -321,7 +321,7 @@ unmap(struct dir_info *d, void *p, size_t sz) rsz = mopts.malloc_cache - d->free_regions_size; if (psz > rsz) tounmap = psz - rsz; - offset = getrnibble() + getrnibble() << 4; + offset = getrnibble() + (getrnibble() << 4); for (i = 0; tounmap > 0 && i < mopts.malloc_cache; i++) { r = &d->free_regions[(i + offset) & (mopts.malloc_cache - 1)]; if (r->p != NULL) { @@ -402,7 +402,7 @@ map(struct dir_info *d, size_t sz, int zero_fill) /* zero fill not needed */ return p; } - offset = getrnibble() + getrnibble() << 4; + offset = getrnibble() + (getrnibble() << 4); for (i = 0; i < mopts.malloc_cache; i++) { r = &d->free_regions[(i + offset) & (mopts.malloc_cache - 1)]; if (r->p != NULL) { |