[Bug libc/3313] New: madvise(M_MXFAST,0) sets up a crash

[Bug libc/3313] New: madvise(M_MXFAST,0) sets up a crash

[pasky at suse dot cz]

When a program calls madvise(M_MXFAST, 0), it will crash the next time it tries
to do some memory allocation or get into an infinite loop when it remadvises
M_MXFAST to some other value. The problem probably stems from the handling of
the first two "unindexable" bins (although I'm not sure right now how are they
unindexable) - madvise(M_MXFAST, 0) will set the max_fast to SMALLBIN_WIDTH but
fastbin_index(SMALLBIN_WIDTH) == -1, which ain't any good when you use that as
an index to the buckets array.

-- 
           Summary: madvise(M_MXFAST,0) sets up a crash
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: pasky at suse dot cz
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=3313

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/3313] madvise(M_MXFAST,0) sets up a crash

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2006-10-13 20:53 -------
I couldn't reproduce the problem but there were two things clearly wrong.  Both
were not introduced by the renumbering of the fast bins, they existed before. 
But the renumbering exposed the problems.

The CVS code should be fix.  Try it and report back.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=3313

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.