From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <libc-hacker-return-9090-listarch-libc-hacker=sources.redhat.com@sourceware.org>
Received: (qmail 7189 invoked by alias); 17 Oct 2006 12:21:32 -0000
Received: (qmail 7172 invoked by uid 22791); 17 Oct 2006 12:21:31 -0000
X-Spam-Check-By: sourceware.org
Received: from sunsite.ms.mff.cuni.cz (HELO sunsite.mff.cuni.cz) (195.113.15.26)
    by sourceware.org (qpsmtpd/0.31) with ESMTP; Tue, 17 Oct 2006 12:21:27 +0000
Received: from sunsite.mff.cuni.cz (sunsite.mff.cuni.cz [127.0.0.1])
	by sunsite.mff.cuni.cz (8.13.1/8.13.1) with ESMTP id k9HCLMHY018334;
	Tue, 17 Oct 2006 14:21:22 +0200
Received: (from jj@localhost)
	by sunsite.mff.cuni.cz (8.13.1/8.13.1/Submit) id k9HCLMUs018333;
	Tue, 17 Oct 2006 14:21:22 +0200
Date: Tue, 17 Oct 2006 12:21:00 -0000
From: Jakub Jelinek <jakub@redhat.com>
To: Ulrich Drepper <drepper@redhat.com>
Cc: Glibc hackers <libc-hacker@sources.redhat.com>
Subject: [PATCH] Fix malloc_consolidate
Message-ID: <20061017122122.GD5868@sunsite.mff.cuni.cz>
Reply-To: Jakub Jelinek <jakub@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4.1i
Mailing-List: contact libc-hacker-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Subscribe: <mailto:libc-hacker-subscribe@sourceware.org>
List-Archive: <http://sourceware.org/ml/libc-hacker/>
List-Post: <mailto:libc-hacker@sourceware.org>
List-Help: <mailto:libc-hacker-help@sourceware.org>, <http://sourceware.org/ml/#faqs>
Sender: libc-hacker-owner@sourceware.org
X-SW-Source: 2006-10/txt/msg00009.txt.bz2

Hi!

The last malloc_consolidate change causes crashes.  The do while loop
has fb++ != maxfb condition, so fb in the last iteration is equal to maxfb.
Thus, maxfb can't be pointer to the end of the array, but must point to the
last element in it.

2006-10-17  Jakub Jelinek  <jakub@redhat.com>

	[BZ #3313]
	* malloc/malloc.c (malloc_consolidate): Set maxfb to address of last
	fastbin rather than end of fastbin array.

--- libc/malloc/malloc.c.jj	2006-10-17 10:29:08.000000000 +0200
+++ libc/malloc/malloc.c	2006-10-17 14:09:56.000000000 +0200
@@ -4699,7 +4699,7 @@ static void malloc_consolidate(av) mstat
        search all bins all the time.  */
     maxfb = &(av->fastbins[fastbin_index(get_max_fast ())]);
 #else
-    maxfb = &(av->fastbins[NFASTBINS]);
+    maxfb = &(av->fastbins[NFASTBINS - 1]);
 #endif
     fb = &(av->fastbins[0]);
     do {

	Jakub