* malloc/arena.c (ptmalloc_init): Recognize MALLOC_PERTURB_ and call

	mallopt appropriately.
	* malloc/malloc.h: Define M_PERTURB.
	* malloc/malloc.c (perturb_byte): New variable.
	(alloc_perturb, free_perturb): New macros.
	(_int_malloc): Before returning, overwrite the memory if this is
	requested.
	(_int_free): Overwrite freed memory if requested.
	(mALLOPt): Handle M_PERTURB.
	* test-skeleton.c: Add call to mallopt with M_PERTURB command.

4 files changed, 72 insertions, 16 deletions

diff --git a/ChangeLog b/ChangeLog
index 8826d75b88..7816aa65ee 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,16 @@
 2005-03-07  Ulrich Drepper  <drepper@redhat.com>
 
+	* malloc/arena.c (ptmalloc_init): Recognize MALLOC_PERTURB_ and call
+	mallopt appropriately.
+	* malloc/malloc.h: Define M_PERTURB.
+	* malloc/malloc.c (perturb_byte): New variable.
+	(alloc_perturb, free_perturb): New macros.
+	(_int_malloc): Before returning, overwrite the memory if this is
+	requested.
+	(_int_free): Overwrite freed memory if requested.
+	(mALLOPt): Handle M_PERTURB.
+	* test-skeleton.c: Add call to mallopt with M_PERTURB command.
+
 	* elf/dl-close.c (_dl_close): Decrement l_opencount before
 	printing debug message.
 	* elf/dl-open.c (dl_open_worker): Always print the new opencount
diff --git a/malloc/malloc.c b/malloc/malloc.c
index 5c9e77e9ec..b91f11bdb1 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -2359,6 +2359,14 @@ void weak_variable (*__after_morecore_hook) (void) = NULL;
 static int check_action = DEFAULT_CHECK_ACTION;
 
 
+/* ------------------ Testing support ----------------------------------*/
+
+static int perturb_byte;
+
+#define alloc_perturb(p, n) memset (p, (perturb_byte ^ 0xff) & 0xff, n)
+#define free_perturb(p, n) memset (p, perturb_byte & 0xff, n)
+
+
 /* ------------------- Support for multiple arenas -------------------- */
 #include "arena.c"
 
@@ -3859,7 +3867,10 @@ _int_malloc(mstate av, size_t bytes)
 			 chunk2mem (victim));
       *fb = victim->fd;
       check_remalloced_chunk(av, victim, nb);
-      return chunk2mem(victim);
+      void *p = chunk2mem(victim);
+      if (__builtin_expect (perturb_byte, 0))
+	alloc_perturb (p, bytes);
+      return p;
     }
   }
 
@@ -3887,7 +3898,10 @@ _int_malloc(mstate av, size_t bytes)
         if (av != &main_arena)
 	  victim->size |= NON_MAIN_ARENA;
         check_malloced_chunk(av, victim, nb);
-        return chunk2mem(victim);
+	void *p = chunk2mem(victim);
+	if (__builtin_expect (perturb_byte, 0))
+	  alloc_perturb (p, bytes);
+	return p;
       }
     }
   }
@@ -3958,7 +3972,10 @@ _int_malloc(mstate av, size_t bytes)
         set_foot(remainder, remainder_size);
 
         check_malloced_chunk(av, victim, nb);
-        return chunk2mem(victim);
+	void *p = chunk2mem(victim);
+	if (__builtin_expect (perturb_byte, 0))
+	  alloc_perturb (p, bytes);
+	return p;
       }
 
       /* remove from unsorted list */
@@ -3972,7 +3989,10 @@ _int_malloc(mstate av, size_t bytes)
 	if (av != &main_arena)
 	  victim->size |= NON_MAIN_ARENA;
         check_malloced_chunk(av, victim, nb);
-        return chunk2mem(victim);
+	void *p = chunk2mem(victim);
+	if (__builtin_expect (perturb_byte, 0))
+	  alloc_perturb (p, bytes);
+	return p;
       }
 
       /* place chunk in bin */
@@ -4041,8 +4061,6 @@ _int_malloc(mstate av, size_t bytes)
           set_inuse_bit_at_offset(victim, size);
 	  if (av != &main_arena)
 	    victim->size |= NON_MAIN_ARENA;
-          check_malloced_chunk(av, victim, nb);
-          return chunk2mem(victim);
         }
         /* Split */
         else {
@@ -4053,9 +4071,12 @@ _int_malloc(mstate av, size_t bytes)
 		   (av != &main_arena ? NON_MAIN_ARENA : 0));
           set_head(remainder, remainder_size | PREV_INUSE);
           set_foot(remainder, remainder_size);
-          check_malloced_chunk(av, victim, nb);
-          return chunk2mem(victim);
         }
+	check_malloced_chunk(av, victim, nb);
+	void *p = chunk2mem(victim);
+	if (__builtin_expect (perturb_byte, 0))
+	  alloc_perturb (p, bytes);
+	return p;
       }
     }
 
@@ -4124,8 +4145,6 @@ _int_malloc(mstate av, size_t bytes)
           set_inuse_bit_at_offset(victim, size);
 	  if (av != &main_arena)
 	    victim->size |= NON_MAIN_ARENA;
-          check_malloced_chunk(av, victim, nb);
-          return chunk2mem(victim);
         }
 
         /* Split */
@@ -4142,9 +4161,12 @@ _int_malloc(mstate av, size_t bytes)
 		   (av != &main_arena ? NON_MAIN_ARENA : 0));
           set_head(remainder, remainder_size | PREV_INUSE);
           set_foot(remainder, remainder_size);
-          check_malloced_chunk(av, victim, nb);
-          return chunk2mem(victim);
         }
+	check_malloced_chunk(av, victim, nb);
+	void *p = chunk2mem(victim);
+	if (__builtin_expect (perturb_byte, 0))
+	  alloc_perturb (p, bytes);
+	return p;
       }
     }
 
@@ -4176,7 +4198,10 @@ _int_malloc(mstate av, size_t bytes)
       set_head(remainder, remainder_size | PREV_INUSE);
 
       check_malloced_chunk(av, victim, nb);
-      return chunk2mem(victim);
+      void *p = chunk2mem(victim);
+      if (__builtin_expect (perturb_byte, 0))
+	alloc_perturb (p, bytes);
+      return p;
     }
 
     /*
@@ -4194,8 +4219,12 @@ _int_malloc(mstate av, size_t bytes)
     /*
        Otherwise, relay to handle system-dependent cases
     */
-    else
-      return sYSMALLOc(nb, av);
+    else {
+      void *p = sYSMALLOc(nb, av);
+      if (__builtin_expect (perturb_byte, 0))
+	alloc_perturb (p, bytes);
+      return p;
+    }
   }
 }
 
@@ -4269,6 +4298,10 @@ _int_free(mstate av, Void_t* mem)
 	errstr = "double free or corruption (fasttop)";
 	goto errout;
       }
+
+    if (__builtin_expect (perturb_byte, 0))
+      free_perturb (mem, size - SIZE_SZ);
+
     p->fd = *fb;
     *fb = p;
   }
@@ -4310,6 +4343,9 @@ _int_free(mstate av, Void_t* mem)
 	goto errout;
       }
 
+    if (__builtin_expect (perturb_byte, 0))
+      free_perturb (mem, size - SIZE_SZ);
+
     /* consolidate backward */
     if (!prev_inuse(p)) {
       prevsize = p->prev_size;
@@ -5361,6 +5397,10 @@ int mALLOPt(param_number, value) int param_number; int value;
   case M_CHECK_ACTION:
     check_action = value;
     break;
+
+  case M_PERTURB:
+    perturb_byte = value;
+    break;
   }
   (void)mutex_unlock(&av->mutex);
   return res;
diff --git a/malloc/malloc.h b/malloc/malloc.h
index 0f99e837c3..1340aa15bc 100644
--- a/malloc/malloc.h
+++ b/malloc/malloc.h
@@ -122,6 +122,7 @@ extern struct mallinfo mallinfo __MALLOC_P ((void));
 #define M_MMAP_THRESHOLD    -3
 #define M_MMAP_MAX          -4
 #define M_CHECK_ACTION      -5
+#define M_PERTURB	    -6
 
 /* General SVID/XPG interface to tunable parameters. */
 extern int mallopt __MALLOC_P ((int __param, int __val));
diff --git a/test-skeleton.c b/test-skeleton.c
index 9d9a68b62c..dd5d8041dd 100644
--- a/test-skeleton.c
+++ b/test-skeleton.c
@@ -1,5 +1,5 @@
 /* Skeleton for test programs.
-   Copyright (C) 1998,2000,2001,2002,2003,2004 Free Software Foundation, Inc.
+   Copyright (C) 1998,2000-2004, 2005 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@cygnus.com>, 1998.
 
@@ -20,6 +20,7 @@
 
 #include <errno.h>
 #include <getopt.h>
+#include <malloc.h>
 #include <search.h>
 #include <signal.h>
 #include <stdio.h>
@@ -196,6 +197,9 @@ main (int argc, char *argv[])
   unsigned int timeoutfactor = 1;
   pid_t termpid;
 
+  /* Make uses of freed and uninitialized memory known.  */
+  mallopt (M_PERTURB, 42);
+
 #ifdef STDOUT_UNBUFFERED
   setbuf (stdout, NULL);
 #endif