malloc: Ensure that the consolidated fast chunk has a sane size.

1 files changed, 6 insertions, 0 deletions

diff --git a/malloc/malloc.c b/malloc/malloc.c
index 48106f9bd4..f5aafd2c05 100644
--- a/malloc/malloc.c
+++ b/malloc/malloc.c
@@ -4431,6 +4431,12 @@ static void malloc_consolidate(mstate av)
     p = atomic_exchange_acq (fb, NULL);
     if (p != 0) {
       do {
+	{
+	  unsigned int idx = fastbin_index (chunksize (p));
+	  if ((&fastbin (av, idx)) != fb)
+	    malloc_printerr ("malloc_consolidate(): invalid chunk size");
+	}
+
 	check_inuse_chunk(av, p);
 	nextp = p->fd;