Fix perturbing in malloc on free.

diff --git a/ChangeLog b/ChangeLog
index 3f6dd1a..a363552 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-10-24  Ulrich Drepper  <drepper@redhat.com>
+
+       [BZ #12140]
+       * malloc/malloc.c (_int_free): Fill correct number of bytes when
+       perturbing.
+
 2010-10-20  Michael B. Brutman  <brutman@us.ibm.com>
 
        * sysdeps/powerpc/dl-procinfo.c: Add support for ppca2 platform

diff --git a/NEWS b/NEWS
index 48efcbd..23f1e2d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,4 @@
-GNU C Library NEWS -- history of user-visible changes.  2010-10-13
+GNU C Library NEWS -- history of user-visible changes.  2010-10-24
 Copyright (C) 1992-2009, 2010 Free Software Foundation, Inc.
 See the end for copying conditions.
 
@@ -11,7 +11,7 @@ Version 2.13
 
   3268, 7066, 10851, 11611, 11640, 11701, 11840, 11856, 11883, 11903, 11904,
   11968, 11979, 12005, 12037, 12067, 12077, 12078, 12092, 12093, 12107, 12108,
-  12113
+  12113, 12140
 
 * New Linux interfaces: prlimit, prlimit64, fanotify_init, fanotify_mark
 

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 53ee1cc..f7770a3 100644 (file)
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4850,7 +4850,7 @@ _int_free(mstate av, mchunkptr p)
       }
 
     if (__builtin_expect (perturb_byte, 0))
-      free_perturb (chunk2mem(p), size - SIZE_SZ);
+      free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
 
     set_fastchunks(av);
     unsigned int idx = fastbin_index(size);
@@ -4954,7 +4954,7 @@ _int_free(mstate av, mchunkptr p)
       }
 
     if (__builtin_expect (perturb_byte, 0))
-      free_perturb (chunk2mem(p), size - SIZE_SZ);
+      free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);
 
     /* consolidate backward */
     if (!prev_inuse(p)) {