@@ -38,6 +38,7 @@ tests := mallocbug tst-malloc tst-valloc tst-calloc tst-obstack \
tst-malloc_info \
tst-malloc-too-large \
tst-malloc-stats-cancellation \
+ tst-malloc-tcache-count \
tests-static := \
tst-interpose-static-nothread \
@@ -2930,7 +2930,7 @@ tcache_get (size_t tc_idx)
{
tcache_entry *e = tcache->entries[tc_idx];
assert (tc_idx < TCACHE_MAX_BINS);
- assert (tcache->entries[tc_idx] > 0);
+ assert (tcache->counts[tc_idx] > 0);
tcache->entries[tc_idx] = e->next;
--(tcache->counts[tc_idx]);
return (void *) e;
@@ -0,0 +1,54 @@
+/* Ensure tcache count won't overflow, serving chunks from empty tcache bin
+ Copyright (C) 2015-2018 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, see
+ <http://www.gnu.org/licenses/>. */
+
+#include <stdlib.h>
+#include <support/check.h>
+#include <string.h>
+#include <signal.h>
+
+// SZ - arbitrary size to fit the chunk in tcache
+#define SZ 32
+
+/* this is to prevent compiler from optimizing out
+ the test code */
+#pragma GCC optimize ("O0")
+
+static int
+do_test (void)
+{
+ void* p = malloc(SZ);
+ void* q = malloc(SZ);
+
+ free(p);
+ free(q);
+
+ // corrupt the next pointer of last chunk in tcache
+ memcpy(p, &q, sizeof(void*));
+
+ malloc(SZ);
+ malloc(SZ);
+ malloc(SZ);
+
+ FAIL_RET("no assertion due to tcache chunk corruption");
+}
+
+#pragma GCC optimize ("O3")
+
+#define EXPECTED_SIGNAL SIGABRT
+#include <support/test-driver.c>