Skip to content

Commit aaaad9e

Browse files
committed
fix: remove misleading requirement comment on fake_chunk size
fake_chunk->size is not used in computing its value after backward consolidation. It is actually overwritten by b->size + b->prev_size. The original comment stated that fake_chunk->size must be in the smallbins range, which is incorrect.
1 parent 81223bd commit aaaad9e

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

glibc_2.23/house_of_einherjar.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ int main()
3939
size_t fake_chunk[6];
4040

4141
fake_chunk[0] = 0x00; // The prev_size vs. size check is of no concern, until GLIBC 2.26 P->bk->size == P->prev_size check
42-
fake_chunk[1] = 0x100; // size of the chunk just needs to be small enough to stay in the small bin
42+
fake_chunk[1] = 0x00; // Arbitrary value; fake_chunk->size is ignored during backward consolidation.
4343
fake_chunk[2] = (size_t) fake_chunk; // fwd
4444
fake_chunk[3] = (size_t) fake_chunk; // bck
4545
fake_chunk[4] = (size_t) fake_chunk; //fwd_nextsize

glibc_2.24/house_of_einherjar.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ int main()
3939
size_t fake_chunk[6];
4040

4141
fake_chunk[0] = 0x00; // The prev_size vs. size check is of no concern, until GLIBC 2.26 P->bk->size == P->prev_size check
42-
fake_chunk[1] = 0x100; // size of the chunk just needs to be small enough to stay in the small bin
42+
fake_chunk[1] = 0x00; // Arbitrary value; fake_chunk->size is ignored during backward consolidation.
4343
fake_chunk[2] = (size_t) fake_chunk; // fwd
4444
fake_chunk[3] = (size_t) fake_chunk; // bck
4545
fake_chunk[4] = (size_t) fake_chunk; //fwd_nextsize

0 commit comments

Comments
 (0)