@@ -3260,6 +3260,19 @@ __libc_calloc (size_t n, size_t elem_size)
/* Two optional cases in which clearing not necessary */
if (chunk_is_mmapped (p))
{
+ size_t pagesize = GLRO (dl_pagesize);
+ INTERNAL_SIZE_T offset = prev_size (p);
+ INTERNAL_SIZE_T size = chunksize (p);
+ uintptr_t block = (uintptr_t) p - offset;
+ size_t total_size = offset + size;
+ if (__glibc_unlikely ((block | total_size) & (pagesize - 1)) != 0
+ || __glibc_unlikely (!powerof2 ((uintptr_t) mem & (pagesize - 1))))
+ {
+ malloc_printerr (check_action, "calloc(): invalid mmapped chunk",
+ chunk2mem (p), NULL);
+ return 0;
+ }
+
if (__builtin_expect (perturb_byte, 0))
return memset (mem, 0, sz);