Merge branch 'master' of ssh://sources.redhat.com/git/glibc

Conflicts:
	ChangeLog

diff --cc ChangeLog
index 6029367,13f0749..3845caf
--- 1/ChangeLog
--- 2/ChangeLog
+++ b/ChangeLog
@@@ -1,16 -1,9 +1,20 @@@
 +2010-03-24  Ulrich Drepper  <drepper@redhat.com>
 +
 +      [BZ #11389]
 +      * bits/time.h: Define CLOCK_MONOTONIC_RAW, CLOCK_REALTIME_COARSE, and
 +      CLOCK_MONOTONIC_COARSE.
 +      * sysdeps/unix/sysv/linux/clock_getres.c: Handle CLOCK_MONOTONIC_RAW,
 +      CLOCK_REALTIME_COARSE, and CLOCK_MONOTONIC_COARSE.
 +      * sysdeps/unix/sysv/linux/clock_gettime.c: Likewise.
 +      * sysdeps/unix/sysv/linux/clock_settime.c: Likewise.
 +
+ 2010-03-25  Andreas Schwab  <schwab@redhat.com>
+ 
+       * sysdeps/posix/cuserid.c: Fix typo.
+ 
  2010-03-16  Chris Demetriou  <cgd@google.com>
  
 +      [BZ #11394]
        * locale/programs/simple-hash.c: Include inttypes.h.
        (hashval_t): Defined to be uint32_t.
        * locale/programs/simple_hash.h: Include inttypes.h.

diff --cc malloc/malloc.c
index 763852e,763852e..0004c87
--- 1/malloc/malloc.c
--- 2/malloc/malloc.c
+++ b/malloc/malloc.c
@@@ -4852,7 -4852,7 +4852,8 @@@ _int_free(mstate av, mchunkptr p
        free_perturb (chunk2mem(p), size - SIZE_SZ);
  
      set_fastchunks(av);
--    fb = &fastbin (av, fastbin_index(size));
++    unsigned int idx = fastbin_index(size);
++    fb = &fastbin (av, idx);
  
  #ifdef ATOMIC_FASTBINS
      mchunkptr fd;
@@@ -4866,6 -4866,6 +4867,12 @@@
            errstr = "double free or corruption (fasttop)";
            goto errout;
          }
++      if (old != NULL
++          && __builtin_expect (fastbin_index(chunksize(old)) != idx, 0))
++        {
++          errstr = "invalid fastbin entry (free)";
++          goto errout;
++        }
        p->fd = fd = old;
        }
      while ((old = catomic_compare_and_exchange_val_rel (fb, p, fd)) != fd);
@@@ -4877,6 -4877,6 +4884,12 @@@
        errstr = "double free or corruption (fasttop)";
        goto errout;
        }
++    if (*fb != NULL
++      && __builtin_expect (fastbin_index(chunksize(*fb)) != idx, 0))
++      {
++      errstr = "invalid fastbin entry (free)";
++      goto errout;
++      }
  
      p->fd = *fb;
      *fb = p;

diff --cc malloc/tst-mallocstate.c
index 97a1058,97a1058..2a1fd46
--- 1/malloc/tst-mallocstate.c
--- 2/malloc/tst-mallocstate.c
+++ b/malloc/tst-mallocstate.c
@@@ -51,6 -51,6 +51,7 @@@ main (void
  
    for (i=0; i<100; ++i)
      {
++printf("round %li\n", i);
        save_state = malloc_get_state ();
        if (save_state == NULL)
        {
@@@ -64,13 -64,13 +65,18 @@@
        merror ("realloc (i*4) failed.");
        free (save_state);
      }
++puts("done");
  
    p1 = realloc (p1, 40);
++puts("after realloc");
    free (p2);
++puts("after free 1");
    p2 = malloc (10);
++puts("after malloc");
    if (p2 == NULL)
      merror ("malloc (10) failed.");
    free (p1);
++puts("after free 2");
  
    return errors != 0;
  }