From b761bd19aa1ae0f95dd2146397b7f39b44a471b6 Mon Sep 17 00:00:00 2001 From: Rich Felker Date: Mon, 4 Apr 2011 17:26:41 -0400 Subject: fix rare but nasty under-allocation bug in malloc with large requests the bug appeared only with requests roughly 2*sizeof(size_t) to 4*sizeof(size_t) bytes smaller than a multiple of the page size, and only for requests large enough to be serviced by mmap instead of the normal heap. it was only ever observed on 64-bit machines but presumably could also affect 32-bit (albeit with a smaller window of opportunity). --- src/malloc/malloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src') diff --git a/src/malloc/malloc.c b/src/malloc/malloc.c index ee6f170b..46cc21fb 100644 --- a/src/malloc/malloc.c +++ b/src/malloc/malloc.c @@ -333,7 +333,7 @@ void *malloc(size_t n) if (adjust_size(&n) < 0) return 0; if (n > MMAP_THRESHOLD) { - size_t len = n + PAGE_SIZE - 1 & -PAGE_SIZE; + size_t len = n + OVERHEAD + PAGE_SIZE - 1 & -PAGE_SIZE; char *base = __mmap(0, len, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); if (base == (void *)-1) return 0; -- cgit v1.2.1