#define SIZE_BITS (PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)/* Get size, ignoring use bits */#define chunksize(p)         ((p)->size & ~(SIZE_BITS))

#define MINSIZE 4*SIZE_SZ

struct chunk{    size_t prev_size;    size_t size;    chunk *fd;    chunk *bk;//因为链式管理还有可能是双向链表}

x=malloc(0x10);y=malloc(0x10);free(x);free(y);z=malloc(0x10);w=malloc(0x10);

#define request2size(req)                                         \  (((req) + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE)  ?             \   MINSIZE :                                                      \   ((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK)

size_t request2size(size_t req){    chunk_size=SIZE_SZ*4;    while(chunk_size<req)chunk_size+=2*SIZE_SZ;    return chunk_size;}

/*------------------------ Public wrappers. --------------------------------*/ void *__libc_malloc (size_t bytes){  mstate ar_ptr;  void *victim;   void *(*hook) (size_t, const void *)    = atomic_forced_read (__malloc_hook);  if (__builtin_expect (hook != NULL, 0))    return (*hook)(bytes, RETURN_ADDRESS (0));   arena_get (ar_ptr, bytes);   victim = _int_malloc (ar_ptr, bytes);  /* Retry with another arena only if we were able to find a usable arena     before.  */  if (!victim && ar_ptr != NULL)    {      LIBC_PROBE (memory_malloc_retry, 1, bytes);      ar_ptr = arena_get_retry (ar_ptr, bytes);      victim = _int_malloc (ar_ptr, bytes);    }   if (ar_ptr != NULL)    (void) mutex_unlock (&ar_ptr->mutex);   assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||          ar_ptr == arena_for_chunk (mem2chunk (victim)));  return victim;}

void *(*hook) (size_t, const void *)    = atomic_forced_read (__malloc_hook);if (__builtin_expect (hook != NULL, 0))    return (*hook)(bytes, RETURN_ADDRESS (0));

arena_get (ar_ptr, bytes);victim = _int_malloc (ar_ptr, bytes);

#define arena_get(ptr, size) do { \      arena_lookup (ptr);                           \      arena_lock (ptr, size);                         \  } while (0)

#define arena_lookup(ptr) do { \      void *vptr = NULL;                              \      ptr = (mstate) tsd_getspecific (arena_key, vptr);             \  } while (0)

/* Retry with another arena only if we were able to find a usable arena     before.  */  if (!victim && ar_ptr != NULL)    {      LIBC_PROBE (memory_malloc_retry, 1, bytes);      ar_ptr = arena_get_retry (ar_ptr, bytes);      victim = _int_malloc (ar_ptr, bytes);    }  if (ar_ptr != NULL)      (void) mutex_unlock (&ar_ptr->mutex);  assert (!victim || chunk_is_mmapped (mem2chunk (victim)) ||          ar_ptr == arena_for_chunk (mem2chunk (victim)));  return victim;

INTERNAL_SIZE_T nb;               /* normalized request size */unsigned int idx;                 /* associated bin index */mbinptr bin;                      /* associated bin */ mchunkptr victim;                 /* inspected/selected chunk */INTERNAL_SIZE_T size;             /* its size */int victim_index;                 /* its bin index */ mchunkptr remainder;              /* remainder from a split */unsigned long remainder_size;     /* its size */ unsigned int block;               /* bit map traverser */unsigned int bit;                 /* bit map traverser */unsigned int map;                 /* current word of binmap */ mchunkptr fwd;                    /* misc temp for linking */mchunkptr bck;                    /* misc temp for linking */ const char *errstr = NULL; checked_request2size (bytes, nb); /* There are no usable arenas.  Fall back to sysmalloc to get a chunk from     mmap.  */if (__glibc_unlikely (av == NULL)){    void *p = sysmalloc (nb, av);    if (p != NULL)        alloc_perturb (p, bytes);    return p;}

#define request2size(req)                                         \  (((req) + SIZE_SZ + MALLOC_ALIGN_MASK < MINSIZE)  ?             \   MINSIZE :                                                      \   ((req) + SIZE_SZ + MALLOC_ALIGN_MASK) & ~MALLOC_ALIGN_MASK) /*  Same, except also perform argument check */ #define checked_request2size(req, sz)                             \  if (REQUEST_OUT_OF_RANGE (req)) {                          \      __set_errno (ENOMEM);                              \      return 0;                                      \    }                                          \  (sz) = request2size (req);

__glibc_unlikely(exp)表示exp很可能为假。__glibc_likely(exp)表示exp很可能为真。__builtin_expect(exp,value)表示exp==value大概率成立

/* ------------------ Testing support ----------------------------------*/ static int perturb_byte;static void alloc_perturb (char *p, size_t n){  if (__glibc_unlikely (perturb_byte))    memset (p, perturb_byte ^ 0xff, n);}

#define get_max_fast() global_max_fast#define fastbin_index(sz) \  ((((unsigned int) (sz)) >> (SIZE_SZ == 8 ? 4 : 3)) - 2)#define fastbin(ar_ptr, idx) ((ar_ptr)->fastbinsY[idx]) if ((unsigned long) (nb) <= (unsigned long) (get_max_fast ())){    idx = fastbin_index (nb);    mfastbinptr *fb = &fastbin (av, idx);    mchunkptr pp = *fb;    do    {        victim = pp;        if (victim == NULL)            break;    }    while ((pp = catomic_compare_and_exchange_val_acq (fb, victim->fd, victim))           != victim);    if (victim != 0)    {        if (__builtin_expect (fastbin_index (chunksize (victim)) != idx, 0))//在malloc的时候检查了fastbin的size发现不对        {            errstr = "malloc(): memory corruption (fast)";            errout:            malloc_printerr (check_action, errstr, chunk2mem (victim), av);            return NULL;        }        check_remalloced_chunk (av, victim, nb);        void *p = chunk2mem (victim);        alloc_perturb (p, bytes);        return p;    }}

/*   Properties of chunks recycled from fastbins */ static voiddo_check_remalloced_chunk (mstate av, mchunkptr p, INTERNAL_SIZE_T s){  INTERNAL_SIZE_T sz = p->size & ~(PREV_INUSE | NON_MAIN_ARENA);   if (!chunk_is_mmapped (p))    {      assert (av == arena_for_chunk (p));      if (chunk_non_main_arena (p))        assert (av != &main_arena);      else        assert (av == &main_arena);    }   do_check_inuse_chunk (av, p);   /* Legal size ... */  assert ((sz & MALLOC_ALIGN_MASK) == 0);  assert ((unsigned long) (sz) >= MINSIZE);  /* ... and alignment */  assert (aligned_OK (chunk2mem (p)));  /* chunk is less than MINSIZE more than request */  assert ((long) (sz) - (long) (s) >= 0);  assert ((long) (sz) - (long) (s + MINSIZE) < 0);}

#define NBINS             128#define NSMALLBINS         64#define SMALLBIN_WIDTH    MALLOC_ALIGNMENT#define SMALLBIN_CORRECTION (MALLOC_ALIGNMENT > 2 * SIZE_SZ)#define MIN_LARGE_SIZE    ((NSMALLBINS - SMALLBIN_CORRECTION) * SMALLBIN_WIDTH) #define in_smallbin_range(sz)  \  ((unsigned long) (sz) < (unsigned long) MIN_LARGE_SIZE) #define smallbin_index(sz) \  ((SMALLBIN_WIDTH == 16 ? (((unsigned) (sz)) >> 4) : (((unsigned) (sz)) >> 3))\   + SMALLBIN_CORRECTION)#define bin_at(m, i) \  (mbinptr) (((char *) &((m)->bins[((i) - 1) * 2]))                  \             - offsetof (struct malloc_chunk, fd))#define first(b)     ((b)->fd)#define last(b)      ((b)->bk)     /*     If a small request, check regular bin.  Since these "smallbins"     hold one size each, no searching within bins is necessary.     (For a large request, we need to wait until unsorted chunks are     processed to find best fit. But for small ones, fits are exact     anyway, so we can check now, which is faster.)   */   if (in_smallbin_range (nb))    {      idx = smallbin_index (nb);      bin = bin_at (av, idx);       if ((victim = last (bin)) != bin)        {          if (victim == 0) /* initialization check */            malloc_consolidate (av);          else            {              bck = victim->bk;    if (__glibc_unlikely (bck->fd != victim))                {                  errstr = "malloc(): smallbin double linked list corrupted";                  goto errout;                }              set_inuse_bit_at_offset (victim, nb);              bin->bk = bck;              bck->fd = bin;               if (av != &main_arena)                victim->size |= NON_MAIN_ARENA;              check_malloced_chunk (av, victim, nb);              void *p = chunk2mem (victim);              alloc_perturb (p, bytes);              return p;            }        }    }

static void malloc_consolidate(mstate av){  mfastbinptr*    fb;                 /* current fastbin being consolidated */  mfastbinptr*    maxfb;              /* last fastbin (for loop control) */  mchunkptr       p;                  /* current chunk being consolidated */  mchunkptr       nextp;              /* next chunk to consolidate */  mchunkptr       unsorted_bin;       /* bin header */  mchunkptr       first_unsorted;     /* chunk to link to */   /* These have same use as in free() */  mchunkptr       nextchunk;  INTERNAL_SIZE_T size;  INTERNAL_SIZE_T nextsize;  INTERNAL_SIZE_T prevsize;  int             nextinuse;  mchunkptr       bck;  mchunkptr       fwd;   /*    If max_fast is 0, we know that av hasn't    yet been initialized, in which case do so below  */   if (get_max_fast () != 0) {    clear_fastchunks(av);     unsorted_bin = unsorted_chunks(av);     /*      Remove each chunk from fast bin and consolidate it, placing it      then in unsorted bin. Among other reasons for doing this,      placing in unsorted bin avoids needing to calculate actual bins      until malloc is sure that chunks aren't immediately going to be      reused anyway.    */mlined version of consolidation code in free() *     maxfb = &fastbin (av, NFASTBINS - 1);    fb = &fastbin (av, 0);    do {      p = atomic_exchange_acq (fb, 0);      if (p != 0) {    do {      check_inuse_chunk(av, p);      nextp = p->fd;       /* Slightly streamlined version of consolidation code in free() */      size = p->size & ~(PREV_INUSE|NON_MAIN_ARENA);      nextchunk = chunk_at_offset(p, size);      nextsize = chunksize(nextchunk);       if (!prev_inuse(p)) {        prevsize = p->prev_size;        size += prevsize;        p = chunk_at_offset(p, -((long) prevsize));        unlink(av, p, bck, fwd);      }       if (nextchunk != av->top) {        nextinuse = inuse_bit_at_offset(nextchunk, nextsize);         if (!nextinuse) {          size += nextsize;          unlink(av, nextchunk, bck, fwd);        } else          clear_inuse_bit_at_offset(nextchunk, 0);         first_unsorted = unsorted_bin->fd;        unsorted_bin->fd = p;        first_unsorted->bk = p;         if (!in_smallbin_range (size)) {          p->fd_nextsize = NULL;          p->bk_nextsize = NULL;        }         set_head(p, size | PREV_INUSE);        p->bk = unsorted_bin;        p->fd = first_unsorted;        set_foot(p, size);      }       else {        size += nextsize;        set_head(p, size | PREV_INUSE);        av->top = p;      }     } while ( (p = nextp) != 0);       }    } while (fb++ != maxfb);  }  else {    malloc_init_state(av);    check_malloc_state(av);  }}

#define set_inuse_bit_at_offset(p, s)                          \  (((mchunkptr) (((char *) (p)) + (s)))->size |= PREV_INUSE)#define chunk2mem(p)   ((void*)((char*)(p) + 2*SIZE_SZ))bck = victim->bk;if (__glibc_unlikely (bck->fd != victim)){    errstr = "malloc(): smallbin double linked list corrupted";    goto errout;}set_inuse_bit_at_offset (victim, nb);bin->bk = bck;bck->fd = bin; if (av != &main_arena)victim->size |= NON_MAIN_ARENA;check_malloced_chunk (av, victim, nb);void *p = chunk2mem (victim);alloc_perturb (p, bytes);return p;

victim->fd->bk=victim->bk;victime->bk->fd=victim->fd;

else{    idx = largebin_index (nb);    if (have_fastchunks (av))        malloc_consolidate (av);}

for (;; )    {      int iters = 0;      while ((victim = unsorted_chunks (av)->bk) != unsorted_chunks (av))        {          bck = victim->bk;          if (__builtin_expect (victim->size <= 2 * SIZE_SZ, 0)              || __builtin_expect (victim->size > av->system_mem, 0))            malloc_printerr (check_action, "malloc(): memory corruption",                             chunk2mem (victim), av);          size = chunksize (victim);           /*             If a small request, try to use last remainder if it is the             only chunk in unsorted bin.  This helps promote locality for             runs of consecutive small requests. This is the only             exception to best-fit, and applies only when there is             no exact fit for a small chunk.           */           ......         }    ......    }

if (in_smallbin_range (nb) &&bck == unsorted_chunks (av) &&victim == av->last_remainder &&(unsigned long) (size) > (unsigned long) (nb + MINSIZE)){    /* split and reattach remainder */    remainder_size = size - nb;    remainder = chunk_at_offset (victim, nb);    unsorted_chunks (av)->bk = unsorted_chunks (av)->fd = remainder;    av->last_remainder = remainder;    remainder->bk = remainder->fd = unsorted_chunks (av);    if (!in_smallbin_range (remainder_size))    {        remainder->fd_nextsize = NULL;        remainder->bk_nextsize = NULL;    }     set_head (victim, nb | PREV_INUSE |    (av != &main_arena ? NON_MAIN_ARENA : 0));    set_head (remainder, remainder_size | PREV_INUSE);    set_foot (remainder, remainder_size);     check_malloced_chunk (av, victim, nb);    void *p = chunk2mem (victim);    alloc_perturb (p, bytes);    return p;}

/* remove from unsorted list */unsorted_chunks (av)->bk = bck;bck->fd = unsorted_chunks (av); /* Take now instead of binning if exact fit */ if (size == nb){    set_inuse_bit_at_offset (victim, size);    if (av != &main_arena)        victim->size |= NON_MAIN_ARENA;    check_malloced_chunk (av, victim, nb);    void *p = chunk2mem (victim);    alloc_perturb (p, bytes);    return p;} /* place chunk in bin */ if (in_smallbin_range (size)){    victim_index = smallbin_index (size);    bck = bin_at (av, victim_index);    fwd = bck->fd;}

else{    victim_index = largebin_index (size);    bck = bin_at (av, victim_index);    fwd = bck->fd;     /* maintain large bins in sorted order */    if (fwd != bck)    {        /* Or with inuse bit to speed comparisons */        size |= PREV_INUSE;        /* if smaller than smallest, bypass loop below */        assert ((bck->bk->size & NON_MAIN_ARENA) == 0);        if ((unsigned long) (size) < (unsigned long) (bck->bk->size))        {            fwd = bck;            bck = bck->bk;             victim->fd_nextsize = fwd->fd;            victim->bk_nextsize = fwd->fd->bk_nextsize;            fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim;        }        else        {            assert ((fwd->size & NON_MAIN_ARENA) == 0);            while ((unsigned long) size < fwd->size)            {                fwd = fwd->fd_nextsize;                assert ((fwd->size & NON_MAIN_ARENA) == 0);            }             if ((unsigned long) size == (unsigned long) fwd->size)                /* Always insert in the second position.  */                fwd = fwd->fd;            else            {                victim->fd_nextsize = fwd;                victim->bk_nextsize = fwd->bk_nextsize;                fwd->bk_nextsize = victim;                victim->bk_nextsize->fd_nextsize = victim;            }            bck = fwd->bk;        }    }    else        victim->fd_nextsize = victim->bk_nextsize = victim;}

fwd=bin->fd;bck=bin->bk;victim->bk_nextsize=bck;victim->fd_nextsize=fwd;fwd->bk_nextsize=bck->fd_nextsize=victim;

mark_bin (av, victim_index);victim->bk = bck;victim->fd = fwd;fwd->bk = victim;bck->fd = victim;#define MAX_ITERS       10000if (++iters >= MAX_ITERS)    break;

if (!in_smallbin_range (nb)){    bin = bin_at (av, idx);     /* skip scan if empty or largest chunk is too small */    if ((victim = first (bin)) != bin &&        (unsigned long) (victim->size) >= (unsigned long) (nb))    {        victim = victim->bk_nextsize;        while (((unsigned long) (size = chunksize (victim)) <                (unsigned long) (nb)))            victim = victim->bk_nextsize;         /* Avoid removing the first entry for a size so that the skip                 list does not have to be rerouted.  */        if (victim != last (bin) && victim->size == victim->fd->size)            victim = victim->fd;         remainder_size = size - nb;        unlink (av, victim, bck, fwd);         /* Exhaust */        if (remainder_size < MINSIZE)        {            set_inuse_bit_at_offset (victim, size);            if (av != &main_arena)                victim->size |= NON_MAIN_ARENA;        }        /* Split */        else        {            remainder = chunk_at_offset (victim, nb);            /* We cannot assume the unsorted list is empty and therefore                     have to perform a complete insert here.  */            bck = unsorted_chunks (av);            fwd = bck->fd;            if (__glibc_unlikely (fwd->bk != bck))            {                errstr = "malloc(): cor                    rupted unsorted chunks";                goto errout;            }            remainder->bk = bck;            remainder->fd = fwd;            bck->fd = remainder;            fwd->bk = remainder;            if (!in_smallbin_range (remainder_size))            {                remainder->fd_nextsize = NULL;                remainder->bk_nextsize = NULL;            }            set_head (victim, nb | PREV_INUSE |                      (av != &main_arena ? NON_MAIN_ARENA : 0));            set_head (remainder, remainder_size | PREV_INUSE);            set_foot (remainder, remainder_size);        }        check_malloced_chunk (av, victim, nb);        void *p = chunk2mem (victim);        alloc_perturb (p, bytes);        return p;    }}

++idx;bin = bin_at (av, idx);block = idx2block (idx);map = av->binmap[block];bit = idx2bit (idx);

for(;;){    /* Skip rest of block if there are no more set bits in this block.  */    if (bit > map || bit == 0)    {        do        {            if (++block >= BINMAPSIZE) /* out of bins */                goto use_top;        }        while ((map = av->binmap[block]) == 0);         bin = bin_at (av, (block << BINMAPSHIFT));        bit = 1;    }    ........}

/* Advance to bin with set bit. There must be one. */while ((bit & map) == 0){    bin = next_bin (bin);    bit <<= 1;    assert (bit != 0);} /* Inspect the bin. It is likely to be non-empty */victim = last (bin); /*  If a false alarm (empty bin), clear the bit. */if (victim == bin){    av->binmap[block] = map &= ~bit; /* Write through */    bin = next_bin (bin);    bit <<= 1;}

else{    size = chunksize (victim);     /*  We know the first chunk in this bin is big enough to use. */    assert ((unsigned long) (size) >= (unsigned long) (nb));     remainder_size = size - nb;     /* unlink */    unlink (av, victim, bck, fwd);     /* Exhaust */    if (remainder_size < MINSIZE)    {        set_inuse_bit_at_offset (victim, size);        if (av != &main_arena)        victim->size |= NON_MAIN_ARENA;    }     /* Split */    else    {        remainder = chunk_at_offset (victim, nb);         /* We cannot assume the unsorted list is empty and therefore        have to perform a complete insert here.  */        bck = unsorted_chunks (av);        fwd = bck->fd;        if (__glibc_unlikely (fwd->bk != bck))        {            errstr = "malloc(): corrupted unsorted chunks 2";            goto errout;        }        remainder->bk = bck;        remainder->fd = fwd;        bck->fd = remainder;        fwd->bk = remainder;         /* advertise as last remainder */        if (in_smallbin_range (nb))        av->last_remainder = remainder;        if (!in_smallbin_range (remainder_size))        {            remainder->fd_nextsize = NULL;            remainder->bk_nextsize = NULL;        }        set_head (victim, nb | PREV_INUSE |        (av != &main_arena ? NON_MAIN_ARENA : 0));        set_head (remainder, remainder_size | PREV_INUSE);        set_foot (remainder, remainder_size);    }    check_malloced_chunk (av, victim, nb);    void *p = chunk2mem (victim);    alloc_perturb (p, bytes);    return p;}

use_top:    /*             If large enough, split off the chunk bordering the end of memory             (held in av->top). Note that this is in accord with the best-fit             search rule.  In effect, av->top is treated as larger (and thus             less well fitting) than any other available chunk since it can             be extended to be as large as necessary (up to system             limitations).              We require that av->top always exists (i.e., has size >=             MINSIZE) after initialization, so if it would otherwise be             exhausted by current request, it is replenished. (The main             reason for ensuring it exists is that we may need MINSIZE space             to put in fenceposts in sysmalloc.)           */     victim = av->top;    size = chunksize (victim);     if ((unsigned long) (size) >= (unsigned long) (nb + MINSIZE))    {        remainder_size = size - nb;        remainder = chunk_at_offset (victim, nb);        av->top = remainder;        set_head (victim, nb | PREV_INUSE |                  (av != &main_arena ? NON_MAIN_ARENA : 0));        set_head (remainder, remainder_size | PREV_INUSE);         check_malloced_chunk (av, victim, nb);        void *p = chunk2mem (victim);        alloc_perturb (p, bytes);        return p;    }     /* When we are using atomic ops to free fast chunks we can get             here for all block sizes.  */    else if (have_fastchunks (av))    {         else if (have_fastchunks (av))        {            malloc_consolidate (av);            /* restore original bin index */            if (in_smallbin_range (nb))                idx = smallbin_index (nb);            else                idx = largebin_index (nb);        }         /*                 Otherwise, relay to handle system-dependent cases               */        else        {            void *p = sysmalloc (nb, av);            if (p != NULL)                alloc_perturb (p, bytes);            return p;        }    }}

void__libc_free (void *mem){  mstate ar_ptr;  mchunkptr p;                          /* chunk corresponding to mem */   void (*hook) (void *, const void *)    = atomic_forced_read (__free_hook);  if (__builtin_expect (hook != NULL, 0))    {      (*hook)(mem, RETURN_ADDRESS (0));      return;    }   if (mem == 0)                              /* free(0) has no effect */    return;   p = mem2chunk (mem);   if (chunk_is_mmapped (p))                       /* release mmapped memory. */    {      /* see if the dynamic brk/mmap threshold needs adjusting */      if (!mp_.no_dyn_threshold          && p->size > mp_.mmap_threshold          && p->size <= DEFAULT_MMAP_THRESHOLD_MAX)        {          mp_.mmap_threshold = chunksize (p);          mp_.trim_threshold = 2 * mp_.mmap_threshold;          LIBC_PROBE (memory_mallopt_free_dyn_thresholds, 2,                      mp_.mmap_threshold, mp_.trim_threshold);        }      munmap_chunk (p);      return;    }   ar_ptr = arena_for_chunk (p);  _int_free (ar_ptr, p, 0);}

#define MALLOC_ALIGNMENT       (2 *SIZE_SZ)#define MALLOC_ALIGN_MASK      (MALLOC_ALIGNMENT - 1)#define misaligned_chunk(p) \  ((uintptr_t)(MALLOC_ALIGNMENT == 2 * SIZE_SZ ? (p) : chunk2mem (p)) \   & MALLOC_ALIGN_MASK)#define SIZE_BITS (PREV_INUSE | IS_MMAPPED | NON_MAIN_ARENA)/* Get size, ignoring use bits */#define chunksize(p)         ((p)->size & ~(SIZE_BITS))INTERNAL_SIZE_T size;        /* its size */mfastbinptr *fb;             /* associated fastbin */mchunkptr nextchunk;         /* next contiguous chunk */INTERNAL_SIZE_T nextsize;    /* its size */int nextinuse;               /* true if nextchunk is used */INTERNAL_SIZE_T prevsize;    /* size of previous contiguous chunk */mchunkptr bck;               /* misc temp for linking */mchunkptr fwd;               /* misc temp for linking */ const char *errstr = NULL;int locked = 0; size = chunksize (p); /* Little security check which won't hurt performance: the     allocator never wrapps around at the end of the address space.     Therefore we can exclude some size values which might appear     here by accident or by "design" from some intruder.  */if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)    || __builtin_expect (misaligned_chunk (p), 0)){    errstr = "free(): invalid pointer";    errout:    if (!have_lock && locked)        (void) mutex_unlock (&av->mutex);    malloc_printerr (check_action, errstr, chunk2mem (p), av);    return;}

#define aligned_OK(m)  (((unsigned long)(m) & MALLOC_ALIGN_MASK) == 0)/* We know that each chunk is at least MINSIZE bytes in size or a     multiple of MALLOC_ALIGNMENT.  */if (__glibc_unlikely (size < MINSIZE || !aligned_OK (size))){    errstr = "free(): invalid size";    goto errout;} check_inuse_chunk(av, p);

#define next_chunk(p) ((mchunkptr) (((char *) (p)) + ((p)->size & ~SIZE_BITS)))static voiddo_check_inuse_chunk (mstate av, mchunkptr p){  mchunkptr next;   do_check_chunk (av, p);   if (chunk_is_mmapped (p))    return; /* mmapped chunks have no next/prev */   /* Check whether it claims to be in use ... */  assert (inuse (p));   next = next_chunk (p);   /* ... and is surrounded by OK chunks.     Since more things can be checked with free chunks than inuse ones,     if an inuse chunk borders them and debug is on, it's worth doing them.   */  if (!prev_inuse (p))    {      /* Note that we cannot even look at prev unless it is not inuse */      mchunkptr prv = prev_chunk (p);      assert (next_chunk (prv) == p);      do_check_free_chunk (av, prv);    }   if (next == av->top)    {      assert (prev_inuse (next));      assert (chunksize (next) >= MINSIZE);    }  else if (!inuse (next))    do_check_free_chunk (av, next);}

if ((unsigned long)(size) <= (unsigned long)(get_max_fast ()) #if TRIM_FASTBINS/*If TRIM_FASTBINS set, don't place chunksbordering top into fastbins*/&& (chunk_at_offset(p, size) != av->top)#endif){     if (__builtin_expect (chunk_at_offset (p, size)->size <= 2 * SIZE_SZ, 0)    || __builtin_expect (chunksize (chunk_at_offset (p, size))    >= av->system_mem, 0))    {        /* We might not have a lock at this point and concurrent modifications        of system_mem might have let to a false positive.  Redo the test        after getting the lock.  */        if (have_lock        || ({ assert (locked == 0);        mutex_lock(&av->mutex);        locked = 1;        chunk_at_offset (p, size)->size <= 2 * SIZE_SZ        || chunksize (chunk_at_offset (p, size)) >= av->system_mem;        }))        {            errstr = "free(): invalid next size (fast)";            goto errout;        }        if (! have_lock)        {            (void)mutex_unlock(&av->mutex);            locked = 0;        }    }    ........}

#define FASTCHUNKS_BIT        (1U)#define set_fastchunks(M)      catomic_and (&(M)->flags, ~FASTCHUNKS_BIT)if ((unsigned long)(size) <= (unsigned long)(get_max_fast ()) #if TRIM_FASTBINS/*If TRIM_FASTBINS set, don't place chunksbordering top into fastbins*/&& (chunk_at_offset(p, size) != av->top)#endif){    ......    free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);     set_fastchunks(av);    unsigned int idx = fastbin_index(size);    fb = &fastbin (av, idx);     /* Atomically link P to its fastbin: P->FD = *FB; *FB = P;  */    mchunkptr old = *fb, old2;    unsigned int old_idx = ~0u;    do    {        /* Check that the top of the bin is not the record we are going to add        (i.e., double free).  */        if (__builtin_expect (old == p, 0))        {            errstr = "double free or corruption (fasttop)";            goto errout;        }        /* Check that size of fastbin chunk at the top is the same as        size of the chunk that we are adding.  We can dereference OLD        only if we have the lock, otherwise it might have already been        deallocated.  See use of OLD_IDX below for the actual check.  */        if (have_lock && old != NULL)            old_idx = fastbin_index(chunksize(old));        p->fd = old2 = old;    }    while ((old = catomic_compare_and_exchange_val_rel (fb, p, old2)) != old2);     if (have_lock && old != NULL && __builtin_expect (old_idx != idx, 0))    {        errstr = "invalid fastbin entry (free)";        goto errout;    }}

//free_perturbstatic voidfree_perturb (char *p, size_t n){  if (__glibc_unlikely (perturb_byte))    memset (p, perturb_byte, n);}

p->fd=av->fastbinY[index]->fd;av->fastbinY[index]->fd=p;

if (! have_lock) {    (void)mutex_lock(&av->mutex);    locked = 1;}......if (! have_lock) {    assert (locked);    (void)mutex_unlock(&av->mutex);}

#define NONCONTIGUOUS_BIT     (2U)#define contiguous(M)          (((M)->flags & NONCONTIGUOUS_BIT) == 0) nextchunk = chunk_at_offset(p, size); /* Lightweight tests: check whether the block is already the       top block.  */if (__glibc_unlikely (p == av->top)){    errstr = "double free or corruption (top)";    goto errout;}/* Or whether the next chunk is beyond the boundaries of the arena.  */if (__builtin_expect (contiguous (av)                      && (char *) nextchunk                      >= ((char *) av->top + chunksize(av->top)), 0)){    errstr = "double free or corruption (out)";    goto errout;}/* Or whether the block is actually not marked used.  */if (__glibc_unlikely (!prev_inuse(nextchunk)))//后面块的prev in use标志位为0时发生free{    errstr = "double free or corruption (!prev)";    goto errout;} nextsize = chunksize(nextchunk);if (__builtin_expect (nextchunk->size <= 2 * SIZE_SZ, 0)    || __builtin_expect (nextsize >= av->system_mem, 0)){    errstr = "free(): invalid next size (normal)";    goto errout;} free_perturb (chunk2mem(p), size - 2 * SIZE_SZ);

/* consolidate backward */if (!prev_inuse(p)) {    prevsize = p->prev_size;    size += prevsize;    p = chunk_at_offset(p, -((long) prevsize));    unlink(av, p, bck, fwd);}

if (nextchunk != av->top) {    /* get and clear inuse bit */    nextinuse = inuse_bit_at_offset(nextchunk, nextsize);     /* consolidate forward */    if (!nextinuse) {        unlink(av, nextchunk, bck, fwd);        size += nextsize;    } else        clear_inuse_bit_at_offset(nextchunk, 0);     /*    Place the chunk in unsorted chunk list. Chunks are    not placed into regular bins until after they have    been given one chance to be used in malloc.      */     bck = unsorted_chunks(av);    fwd = bck->fd;    if (__glibc_unlikely (fwd->bk != bck))    {        errstr = "free(): corrupted unsorted chunks";        goto errout;    }    p->fd = fwd;    p->bk = bck;    if (!in_smallbin_range(size))    {        p->fd_nextsize = NULL;        p->bk_nextsize = NULL;    }    bck->fd = p;    fwd->bk = p;     set_head(p, size | PREV_INUSE);    set_foot(p, size);    check_free_chunk(av, p);} /*      If the chunk borders the current high end of memory,      consolidate into top    */ else {    size += nextsize;    set_head(p, size | PREV_INUSE);    av->top = p;    check_chunk(av, p);}

#define FASTBIN_CONSOLIDATION_THRESHOLD  (65536UL)/*      If freeing a large space, consolidate possibly-surrounding      chunks. Then, if the total unused topmost memory exceeds trim      threshold, ask malloc_trim to reduce top.       Unless max_fast is 0, we don't know if there are fastbins      bordering top, so we cannot tell for sure whether threshold      has been reached unless fastbins are consolidated.  But we      don't want to consolidate on each free.  As a compromise,      consolidation is performed if FASTBIN_CONSOLIDATION_THRESHOLD      is reached.    */ if ((unsigned long)(size) >= FASTBIN_CONSOLIDATION_THRESHOLD) {    if (have_fastchunks(av))        malloc_consolidate(av);     if (av == &main_arena) {        #ifndef MORECORE_CANNOT_TRIM        if ((unsigned long)(chunksize(av->top)) >=            (unsigned long)(mp_.trim_threshold))            systrim(mp_.top_pad, av);        #endif    } else {        /* Always try heap_trim(), even if the top chunk is not       large, because the corresponding heap might go away.  */        heap_info *heap = heap_for_ptr(top(av));         assert(heap->ar_ptr == av);        heap_trim(heap, mp_.top_pad);    }}

# 往期推荐

1.Windows本地代码执行漏洞(CVE-2012-1876)x86/x64平台分析

2.栈溢出原理与实践之读书笔记

3.符号执行挖掘开源库命令注入

4.CVE-2021-4034 pkexec本地提权漏洞复现与原理分析

5.侠盗猎车—玩转滚动码

6.Microsoft Windows提权漏洞CVE-2013-3660 x86、x64双平台分析