(_int_free): Fail if block size is obviously wrong.
authordrepper <drepper>
Thu, 13 Oct 2005 04:46:42 +0000 (04:46 +0000)
committerdrepper <drepper>
Thu, 13 Oct 2005 04:46:42 +0000 (04:46 +0000)
malloc/malloc.c

index a8bc767..4ea3525 100644 (file)
@@ -4278,6 +4278,12 @@ _int_free(mstate av, Void_t* mem)
       malloc_printerr (check_action, errstr, mem);
       return;
     }
+  /* We know that each chunk is at least MINSIZE bytes in size.  */
+  if (__builtin_expect (size < MINSIZE, 0))
+    {
+      errstr = "free(): invalid size";
+      goto errout;
+    }
 
   check_inuse_chunk(av, p);