| commit | ecea0f6125ea87ee6fd82f16286b61eb8c0f5692 | [log] [tgz] |
|---|---|---|
| author | Jason Evans <je@facebook.com> | Wed Apr 28 12:00:59 2010 -0700 |
| committer | Jason Evans <je@facebook.com> | Wed Apr 28 12:00:59 2010 -0700 |
| tree | 22569e0140a58a18202db134e039e23d24ce696b | |
| parent | 5055f4516c8852e67668b0e746863a7d6a1c148e [diff] |
Fix junk filling of cached large objects. Use the size argument to tcache_dalloc_large() to control the number of bytes set to 0x5a when junk filling is enabled, rather than accessing a non-existent arena bin. This bug was capable of corrupting an arbitrarily large memory region, depending on what followed the arena data structure in memory (typically zeroed memory, another arena_t, or a red-black tree node for a huge object).