diff options
| -rw-r--r-- | malloc/malloc.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/malloc/malloc.c b/malloc/malloc.c index 323ad84663..ca7c7e59bc 100644 --- a/malloc/malloc.c +++ b/malloc/malloc.c @@ -4233,7 +4233,7 @@ _int_free(mstate av, Void_t* mem) #endif ) { - if (__builtin_expect (chunksize (chunk_at_offset (p, size)) < 2 * SIZE_SZ, + if (__builtin_expect (chunksize (chunk_at_offset (p, size)) <= 2 * SIZE_SZ, 0) || __builtin_expect (chunksize (chunk_at_offset (p, size)) >= av->system_mem, 0)) @@ -4285,7 +4285,12 @@ _int_free(mstate av, Void_t* mem) } nextsize = chunksize(nextchunk); - assert(nextsize > 0); + if (__builtin_expect (nextsize <= 2 * SIZE_SZ, 0) + || __builtin_expect (nextsize >= av->system_mem, 0)) + { + errstr = "invalid next size (normal)"; + goto errout; + } /* consolidate backward */ if (!prev_inuse(p)) { |