malloc/hooks.c

   1 /* Malloc implementation for multiple threads without lock contention.
   2    Copyright (C) 2001-2006, 2007, 2008, 2009 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4    Contributed by Wolfram Gloger <wg@malloc.de>, 2001.
   5
   6    The GNU C Library is free software; you can redistribute it and/or
   7    modify it under the terms of the GNU Lesser General Public License as
   8    published by the Free Software Foundation; either version 2.1 of the
   9    License, or (at your option) any later version.
  10
  11    The GNU C Library is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14    Lesser General Public License for more details.
  15
  16    You should have received a copy of the GNU Lesser General Public
  17    License along with the GNU C Library; see the file COPYING.LIB.  If not,
  18    write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
  19    Boston, MA 02111-1307, USA.  */
  20
  21 /* What to do if the standard debugging hooks are in place and a
  22    corrupt pointer is detected: do nothing (0), print an error message
  23    (1), or call abort() (2). */
  24
  25 /* Hooks for debugging versions.  The initial hooks just call the
  26    initialization routine, then do the normal work. */
  27
  28 static Void_t*
  29 #if __STD_C
  30 malloc_hook_ini(size_t sz, const __malloc_ptr_t caller)
  31 #else
  32 malloc_hook_ini(sz, caller)
  33      size_t sz; const __malloc_ptr_t caller;
  34 #endif
  35 {
  36   __malloc_hook = NULL;
  37   ptmalloc_init();
  38   return public_mALLOc(sz);
  39 }
  40
  41 static Void_t*
  42 #if __STD_C
  43 realloc_hook_ini(Void_t* ptr, size_t sz, const __malloc_ptr_t caller)
  44 #else
  45 realloc_hook_ini(ptr, sz, caller)
  46      Void_t* ptr; size_t sz; const __malloc_ptr_t caller;
  47 #endif
  48 {
  49   __malloc_hook = NULL;
  50   __realloc_hook = NULL;
  51   ptmalloc_init();
  52   return public_rEALLOc(ptr, sz);
  53 }
  54
  55 static Void_t*
  56 #if __STD_C
  57 memalign_hook_ini(size_t alignment, size_t sz, const __malloc_ptr_t caller)
  58 #else
  59 memalign_hook_ini(alignment, sz, caller)
  60      size_t alignment; size_t sz; const __malloc_ptr_t caller;
  61 #endif
  62 {
  63   __memalign_hook = NULL;
  64   ptmalloc_init();
  65   return public_mEMALIGn(alignment, sz);
  66 }
  67
  68 /* Whether we are using malloc checking.  */
  69 static int using_malloc_checking;
  70
  71 /* A flag that is set by malloc_set_state, to signal that malloc checking
  72    must not be enabled on the request from the user (via the MALLOC_CHECK_
  73    environment variable).  It is reset by __malloc_check_init to tell
  74    malloc_set_state that the user has requested malloc checking.
  75
  76    The purpose of this flag is to make sure that malloc checking is not
  77    enabled when the heap to be restored was constructed without malloc
  78    checking, and thus does not contain the required magic bytes.
  79    Otherwise the heap would be corrupted by calls to free and realloc.  If
  80    it turns out that the heap was created with malloc checking and the
  81    user has requested it malloc_set_state just calls __malloc_check_init
  82    again to enable it.  On the other hand, reusing such a heap without
  83    further malloc checking is safe.  */
  84 static int disallow_malloc_check;
  85
  86 /* Activate a standard set of debugging hooks. */
  87 void
  88 __malloc_check_init()
  89 {
  90   if (disallow_malloc_check) {
  91     disallow_malloc_check = 0;
  92     return;
  93   }
  94   using_malloc_checking = 1;
  95   __malloc_hook = malloc_check;
  96   __free_hook = free_check;
  97   __realloc_hook = realloc_check;
  98   __memalign_hook = memalign_check;
  99 }
 100
 101 /* A simple, standard set of debugging hooks.  Overhead is `only' one
 102    byte per chunk; still this will catch most cases of double frees or
 103    overruns.  The goal here is to avoid obscure crashes due to invalid
 104    usage, unlike in the MALLOC_DEBUG code. */
 105
 106 #define MAGICBYTE(p) ( ( ((size_t)p >> 3) ^ ((size_t)p >> 11)) & 0xFF )
 107
 108 /* Instrument a chunk with overrun detector byte(s) and convert it
 109    into a user pointer with requested size sz. */
 110
 111 static Void_t*
 112 internal_function
 113 #if __STD_C
 114 mem2mem_check(Void_t *ptr, size_t sz)
 115 #else
 116 mem2mem_check(ptr, sz) Void_t *ptr; size_t sz;
 117 #endif
 118 {
 119   mchunkptr p;
 120   unsigned char* m_ptr = (unsigned char*)BOUNDED_N(ptr, sz);
 121   size_t i;
 122
 123   if (!ptr)
 124     return ptr;
 125   p = mem2chunk(ptr);
 126   for(i = chunksize(p) - (chunk_is_mmapped(p) ? 2*SIZE_SZ+1 : SIZE_SZ+1);
 127       i > sz;
 128       i -= 0xFF) {
 129     if(i-sz < 0x100) {
 130       m_ptr[i] = (unsigned char)(i-sz);
 131       break;
 132     }
 133     m_ptr[i] = 0xFF;
 134   }
 135   m_ptr[sz] = MAGICBYTE(p);
 136   return (Void_t*)m_ptr;
 137 }
 138
 139 /* Convert a pointer to be free()d or realloc()ed to a valid chunk
 140    pointer.  If the provided pointer is not valid, return NULL. */
 141
 142 static mchunkptr
 143 internal_function
 144 #if __STD_C
 145 mem2chunk_check(Void_t* mem, unsigned char **magic_p)
 146 #else
 147 mem2chunk_check(mem, magic_p) Void_t* mem; unsigned char **magic_p;
 148 #endif
 149 {
 150   mchunkptr p;
 151   INTERNAL_SIZE_T sz, c;
 152   unsigned char magic;
 153
 154   if(!aligned_OK(mem)) return NULL;
 155   p = mem2chunk(mem);
 156   if (!chunk_is_mmapped(p)) {
 157     /* Must be a chunk in conventional heap memory. */
 158     int contig = contiguous(&main_arena);
 159     sz = chunksize(p);
 160     if((contig &&
 161         ((char*)p<mp_.sbrk_base ||
 162          ((char*)p + sz)>=(mp_.sbrk_base+main_arena.system_mem) )) ||
 163        sz<MINSIZE || sz&MALLOC_ALIGN_MASK || !inuse(p) ||
 164        ( !prev_inuse(p) && (p->prev_size&MALLOC_ALIGN_MASK ||
 165                             (contig && (char*)prev_chunk(p)<mp_.sbrk_base) ||
 166                             next_chunk(prev_chunk(p))!=p) ))
 167       return NULL;
 168     magic = MAGICBYTE(p);
 169     for(sz += SIZE_SZ-1; (c = ((unsigned char*)p)[sz]) != magic; sz -= c) {
 170       if(c<=0 || sz<(c+2*SIZE_SZ)) return NULL;
 171     }
 172   } else {
 173     unsigned long offset, page_mask = malloc_getpagesize-1;
 174
 175     /* mmap()ed chunks have MALLOC_ALIGNMENT or higher power-of-two
 176        alignment relative to the beginning of a page.  Check this
 177        first. */
 178     offset = (unsigned long)mem & page_mask;
 179     if((offset!=MALLOC_ALIGNMENT && offset!=0 && offset!=0x10 &&
 180         offset!=0x20 && offset!=0x40 && offset!=0x80 && offset!=0x100 &&
 181         offset!=0x200 && offset!=0x400 && offset!=0x800 && offset!=0x1000 &&
 182         offset<0x2000) ||
 183        !chunk_is_mmapped(p) || (p->size & PREV_INUSE) ||
 184        ( (((unsigned long)p - p->prev_size) & page_mask) != 0 ) ||
 185        ( (sz = chunksize(p)), ((p->prev_size + sz) & page_mask) != 0 ) )
 186       return NULL;
 187     magic = MAGICBYTE(p);
 188     for(sz -= 1; (c = ((unsigned char*)p)[sz]) != magic; sz -= c) {
 189       if(c<=0 || sz<(c+2*SIZE_SZ)) return NULL;
 190     }
 191   }
 192   ((unsigned char*)p)[sz] ^= 0xFF;
 193   if (magic_p)
 194     *magic_p = (unsigned char *)p + sz;
 195   return p;
 196 }
 197
 198 /* Check for corruption of the top chunk, and try to recover if
 199    necessary. */
 200
 201 static int
 202 internal_function
 203 #if __STD_C
 204 top_check(void)
 205 #else
 206 top_check()
 207 #endif
 208 {
 209   mchunkptr t = top(&main_arena);
 210   char* brk, * new_brk;
 211   INTERNAL_SIZE_T front_misalign, sbrk_size;
 212   unsigned long pagesz = malloc_getpagesize;
 213
 214   if (t == initial_top(&main_arena) ||
 215       (!chunk_is_mmapped(t) &&
 216        chunksize(t)>=MINSIZE &&
 217        prev_inuse(t) &&
 218        (!contiguous(&main_arena) ||
 219         (char*)t + chunksize(t) == mp_.sbrk_base + main_arena.system_mem)))
 220     return 0;
 221
 222   malloc_printerr (check_action, "malloc: top chunk is corrupt", t);
 223
 224   /* Try to set up a new top chunk. */
 225   brk = MORECORE(0);
 226   front_misalign = (unsigned long)chunk2mem(brk) & MALLOC_ALIGN_MASK;
 227   if (front_misalign > 0)
 228     front_misalign = MALLOC_ALIGNMENT - front_misalign;
 229   sbrk_size = front_misalign + mp_.top_pad + MINSIZE;
 230   sbrk_size += pagesz - ((unsigned long)(brk + sbrk_size) & (pagesz - 1));
 231   new_brk = (char*)(MORECORE (sbrk_size));
 232   if (new_brk == (char*)(MORECORE_FAILURE))
 233     {
 234       MALLOC_FAILURE_ACTION;
 235       return -1;
 236     }
 237   /* Call the `morecore' hook if necessary.  */
 238   if (__after_morecore_hook)
 239     (*__after_morecore_hook) ();
 240   main_arena.system_mem = (new_brk - mp_.sbrk_base) + sbrk_size;
 241
 242   top(&main_arena) = (mchunkptr)(brk + front_misalign);
 243   set_head(top(&main_arena), (sbrk_size - front_misalign) | PREV_INUSE);
 244
 245   return 0;
 246 }
 247
 248 static Void_t*
 249 #if __STD_C
 250 malloc_check(size_t sz, const Void_t *caller)
 251 #else
 252 malloc_check(sz, caller) size_t sz; const Void_t *caller;
 253 #endif
 254 {
 255   Void_t *victim;
 256
 257   if (sz+1 == 0) {
 258     MALLOC_FAILURE_ACTION;
 259     return NULL;
 260   }
 261
 262   (void)mutex_lock(&main_arena.mutex);
 263   victim = (top_check() >= 0) ? _int_malloc(&main_arena, sz+1) : NULL;
 264   (void)mutex_unlock(&main_arena.mutex);
 265   return mem2mem_check(victim, sz);
 266 }
 267
 268 static void
 269 #if __STD_C
 270 free_check(Void_t* mem, const Void_t *caller)
 271 #else
 272 free_check(mem, caller) Void_t* mem; const Void_t *caller;
 273 #endif
 274 {
 275   mchunkptr p;
 276
 277   if(!mem) return;
 278   p = mem2chunk_check(mem, NULL);
 279   if(!p) {
 280     malloc_printerr(check_action, "free(): invalid pointer", mem);
 281     return;
 282   }
 283 #if HAVE_MMAP
 284   if (chunk_is_mmapped(p)) {
 285     munmap_chunk(p);
 286     return;
 287   }
 288 #endif
 289 #if 0 /* Erase freed memory. */
 290   memset(mem, 0, chunksize(p) - (SIZE_SZ+1));
 291 #endif
 292 #ifdef ATOMIC_FASTBINS
 293   _int_free(&main_arena, p, 0);
 294 #else
 295   (void)mutex_lock(&main_arena.mutex);
 296   _int_free(&main_arena, p);
 297   (void)mutex_unlock(&main_arena.mutex);
 298 #endif
 299 }
 300
 301 static Void_t*
 302 #if __STD_C
 303 realloc_check(Void_t* oldmem, size_t bytes, const Void_t *caller)
 304 #else
 305 realloc_check(oldmem, bytes, caller)
 306      Void_t* oldmem; size_t bytes; const Void_t *caller;
 307 #endif
 308 {
 309   INTERNAL_SIZE_T nb;
 310   Void_t* newmem = 0;
 311   unsigned char *magic_p;
 312
 313   if (bytes+1 == 0) {
 314     MALLOC_FAILURE_ACTION;
 315     return NULL;
 316   }
 317   if (oldmem == 0) return malloc_check(bytes, NULL);
 318   if (bytes == 0) {
 319     free_check (oldmem, NULL);
 320     return NULL;
 321   }
 322   (void)mutex_lock(&main_arena.mutex);
 323   const mchunkptr oldp = mem2chunk_check(oldmem, &magic_p);
 324   (void)mutex_unlock(&main_arena.mutex);
 325   if(!oldp) {
 326     malloc_printerr(check_action, "realloc(): invalid pointer", oldmem);
 327     return malloc_check(bytes, NULL);
 328   }
 329   const INTERNAL_SIZE_T oldsize = chunksize(oldp);
 330
 331   checked_request2size(bytes+1, nb);
 332   (void)mutex_lock(&main_arena.mutex);
 333
 334 #if HAVE_MMAP
 335   if (chunk_is_mmapped(oldp)) {
 336 #if HAVE_MREMAP
 337     mchunkptr newp = mremap_chunk(oldp, nb);
 338     if(newp)
 339       newmem = chunk2mem(newp);
 340     else
 341 #endif
 342     {
 343       /* Note the extra SIZE_SZ overhead. */
 344       if(oldsize - SIZE_SZ >= nb)
 345         newmem = oldmem; /* do nothing */
 346       else {
 347         /* Must alloc, copy, free. */
 348         if (top_check() >= 0)
 349           newmem = _int_malloc(&main_arena, bytes+1);
 350         if (newmem) {
 351           MALLOC_COPY(BOUNDED_N(newmem, bytes+1), oldmem, oldsize - 2*SIZE_SZ);
 352           munmap_chunk(oldp);
 353         }
 354       }
 355     }
 356   } else {
 357 #endif /* HAVE_MMAP */
 358     if (top_check() >= 0) {
 359       INTERNAL_SIZE_T nb;
 360       checked_request2size(bytes + 1, nb);
 361       newmem = _int_realloc(&main_arena, oldp, oldsize, nb);
 362     }
 363 #if 0 /* Erase freed memory. */
 364     if(newmem)
 365       newp = mem2chunk(newmem);
 366     nb = chunksize(newp);
 367     if(oldp<newp || oldp>=chunk_at_offset(newp, nb)) {
 368       memset((char*)oldmem + 2*sizeof(mbinptr), 0,
 369              oldsize - (2*sizeof(mbinptr)+2*SIZE_SZ+1));
 370     } else if(nb > oldsize+SIZE_SZ) {
 371       memset((char*)BOUNDED_N(chunk2mem(newp), bytes) + oldsize,
 372              0, nb - (oldsize+SIZE_SZ));
 373     }
 374 #endif
 375 #if HAVE_MMAP
 376   }
 377 #endif
 378
 379   /* mem2chunk_check changed the magic byte in the old chunk.
 380      If newmem is NULL, then the old chunk will still be used though,
 381      so we need to invert that change here.  */
 382   if (newmem == NULL) *magic_p ^= 0xFF;
 383
 384   (void)mutex_unlock(&main_arena.mutex);
 385
 386   return mem2mem_check(newmem, bytes);
 387 }
 388
 389 static Void_t*
 390 #if __STD_C
 391 memalign_check(size_t alignment, size_t bytes, const Void_t *caller)
 392 #else
 393 memalign_check(alignment, bytes, caller)
 394      size_t alignment; size_t bytes; const Void_t *caller;
 395 #endif
 396 {
 397   INTERNAL_SIZE_T nb;
 398   Void_t* mem;
 399
 400   if (alignment <= MALLOC_ALIGNMENT) return malloc_check(bytes, NULL);
 401   if (alignment <  MINSIZE) alignment = MINSIZE;
 402
 403   if (bytes+1 == 0) {
 404     MALLOC_FAILURE_ACTION;
 405     return NULL;
 406   }
 407   checked_request2size(bytes+1, nb);
 408   (void)mutex_lock(&main_arena.mutex);
 409   mem = (top_check() >= 0) ? _int_memalign(&main_arena, alignment, bytes+1) :
 410     NULL;
 411   (void)mutex_unlock(&main_arena.mutex);
 412   return mem2mem_check(mem, bytes);
 413 }
 414
 415 #ifndef NO_THREADS
 416
 417 # ifdef _LIBC
 418 #  if USE___THREAD || !defined SHARED
 419     /* These routines are never needed in this configuration.  */
 420 #   define NO_STARTER
 421 #  endif
 422 # endif
 423
 424 # ifdef NO_STARTER
 425 #  undef NO_STARTER
 426 # else
 427
 428 /* The following hooks are used when the global initialization in
 429    ptmalloc_init() hasn't completed yet. */
 430
 431 static Void_t*
 432 #if __STD_C
 433 malloc_starter(size_t sz, const Void_t *caller)
 434 #else
 435 malloc_starter(sz, caller) size_t sz; const Void_t *caller;
 436 #endif
 437 {
 438   Void_t* victim;
 439
 440   victim = _int_malloc(&main_arena, sz);
 441
 442   return victim ? BOUNDED_N(victim, sz) : 0;
 443 }
 444
 445 static Void_t*
 446 #if __STD_C
 447 memalign_starter(size_t align, size_t sz, const Void_t *caller)
 448 #else
 449 memalign_starter(align, sz, caller) size_t align, sz; const Void_t *caller;
 450 #endif
 451 {
 452   Void_t* victim;
 453
 454   victim = _int_memalign(&main_arena, align, sz);
 455
 456   return victim ? BOUNDED_N(victim, sz) : 0;
 457 }
 458
 459 static void
 460 #if __STD_C
 461 free_starter(Void_t* mem, const Void_t *caller)
 462 #else
 463 free_starter(mem, caller) Void_t* mem; const Void_t *caller;
 464 #endif
 465 {
 466   mchunkptr p;
 467
 468   if(!mem) return;
 469   p = mem2chunk(mem);
 470 #if HAVE_MMAP
 471   if (chunk_is_mmapped(p)) {
 472     munmap_chunk(p);
 473     return;
 474   }
 475 #endif
 476 #ifdef ATOMIC_FASTBINS
 477   _int_free(&main_arena, p, 1);
 478 #else
 479   _int_free(&main_arena, p);
 480 #endif
 481 }
 482
 483 # endif /* !defiend NO_STARTER */
 484 #endif /* NO_THREADS */
 485
 486
 487 /* Get/set state: malloc_get_state() records the current state of all
 488    malloc variables (_except_ for the actual heap contents and `hook'
 489    function pointers) in a system dependent, opaque data structure.
 490    This data structure is dynamically allocated and can be free()d
 491    after use.  malloc_set_state() restores the state of all malloc
 492    variables to the previously obtained state.  This is especially
 493    useful when using this malloc as part of a shared library, and when
 494    the heap contents are saved/restored via some other method.  The
 495    primary example for this is GNU Emacs with its `dumping' procedure.
 496    `Hook' function pointers are never saved or restored by these
 497    functions, with two exceptions: If malloc checking was in use when
 498    malloc_get_state() was called, then malloc_set_state() calls
 499    __malloc_check_init() if possible; if malloc checking was not in
 500    use in the recorded state but the user requested malloc checking,
 501    then the hooks are reset to 0.  */
 502
 503 #define MALLOC_STATE_MAGIC   0x444c4541l
 504 #define MALLOC_STATE_VERSION (0*0x100l + 4l) /* major*0x100 + minor */
 505
 506 struct malloc_save_state {
 507   long          magic;
 508   long          version;
 509   mbinptr       av[NBINS * 2 + 2];
 510   char*         sbrk_base;
 511   int           sbrked_mem_bytes;
 512   unsigned long trim_threshold;
 513   unsigned long top_pad;
 514   unsigned int  n_mmaps_max;
 515   unsigned long mmap_threshold;
 516   int           check_action;
 517   unsigned long max_sbrked_mem;
 518   unsigned long max_total_mem;
 519   unsigned int  n_mmaps;
 520   unsigned int  max_n_mmaps;
 521   unsigned long mmapped_mem;
 522   unsigned long max_mmapped_mem;
 523   int           using_malloc_checking;
 524   unsigned long max_fast;
 525   unsigned long arena_test;
 526   unsigned long arena_max;
 527   unsigned long narenas;
 528 };
 529
 530 Void_t*
 531 public_gET_STATe(void)
 532 {
 533   struct malloc_save_state* ms;
 534   int i;
 535   mbinptr b;
 536
 537   ms = (struct malloc_save_state*)public_mALLOc(sizeof(*ms));
 538   if (!ms)
 539     return 0;
 540   (void)mutex_lock(&main_arena.mutex);
 541   malloc_consolidate(&main_arena);
 542   ms->magic = MALLOC_STATE_MAGIC;
 543   ms->version = MALLOC_STATE_VERSION;
 544   ms->av[0] = 0;
 545   ms->av[1] = 0; /* used to be binblocks, now no longer used */
 546   ms->av[2] = top(&main_arena);
 547   ms->av[3] = 0; /* used to be undefined */
 548   for(i=1; i<NBINS; i++) {
 549     b = bin_at(&main_arena, i);
 550     if(first(b) == b)
 551       ms->av[2*i+2] = ms->av[2*i+3] = 0; /* empty bin */
 552     else {
 553       ms->av[2*i+2] = first(b);
 554       ms->av[2*i+3] = last(b);
 555     }
 556   }
 557   ms->sbrk_base = mp_.sbrk_base;
 558   ms->sbrked_mem_bytes = main_arena.system_mem;
 559   ms->trim_threshold = mp_.trim_threshold;
 560   ms->top_pad = mp_.top_pad;
 561   ms->n_mmaps_max = mp_.n_mmaps_max;
 562   ms->mmap_threshold = mp_.mmap_threshold;
 563   ms->check_action = check_action;
 564   ms->max_sbrked_mem = main_arena.max_system_mem;
 565 #ifdef NO_THREADS
 566   ms->max_total_mem = mp_.max_total_mem;
 567 #else
 568   ms->max_total_mem = 0;
 569 #endif
 570   ms->n_mmaps = mp_.n_mmaps;
 571   ms->max_n_mmaps = mp_.max_n_mmaps;
 572   ms->mmapped_mem = mp_.mmapped_mem;
 573   ms->max_mmapped_mem = mp_.max_mmapped_mem;
 574   ms->using_malloc_checking = using_malloc_checking;
 575   ms->max_fast = get_max_fast();
 576 #ifdef PER_THREAD
 577   ms->arena_test = mp_.arena_test;
 578   ms->arena_max = mp_.arena_max;
 579   ms->narenas = narenas;
 580 #endif
 581   (void)mutex_unlock(&main_arena.mutex);
 582   return (Void_t*)ms;
 583 }
 584
 585 int
 586 public_sET_STATe(Void_t* msptr)
 587 {
 588   struct malloc_save_state* ms = (struct malloc_save_state*)msptr;
 589   size_t i;
 590   mbinptr b;
 591
 592   disallow_malloc_check = 1;
 593   ptmalloc_init();
 594   if(ms->magic != MALLOC_STATE_MAGIC) return -1;
 595   /* Must fail if the major version is too high. */
 596   if((ms->version & ~0xffl) > (MALLOC_STATE_VERSION & ~0xffl)) return -2;
 597   (void)mutex_lock(&main_arena.mutex);
 598   /* There are no fastchunks.  */
 599   clear_fastchunks(&main_arena);
 600   if (ms->version >= 4)
 601     set_max_fast(ms->max_fast);
 602   else
 603     set_max_fast(64);   /* 64 used to be the value we always used.  */
 604   for (i=0; i<NFASTBINS; ++i)
 605     fastbin (&main_arena, i) = 0;
 606   for (i=0; i<BINMAPSIZE; ++i)
 607     main_arena.binmap[i] = 0;
 608   top(&main_arena) = ms->av[2];
 609   main_arena.last_remainder = 0;
 610   for(i=1; i<NBINS; i++) {
 611     b = bin_at(&main_arena, i);
 612     if(ms->av[2*i+2] == 0) {
 613       assert(ms->av[2*i+3] == 0);
 614       first(b) = last(b) = b;
 615     } else {
 616       if(ms->version >= 3 &&
 617          (i<NSMALLBINS || (largebin_index(chunksize(ms->av[2*i+2]))==i &&
 618                            largebin_index(chunksize(ms->av[2*i+3]))==i))) {
 619         first(b) = ms->av[2*i+2];
 620         last(b) = ms->av[2*i+3];
 621         /* Make sure the links to the bins within the heap are correct.  */
 622         first(b)->bk = b;
 623         last(b)->fd = b;
 624         /* Set bit in binblocks.  */
 625         mark_bin(&main_arena, i);
 626       } else {
 627         /* Oops, index computation from chunksize must have changed.
 628            Link the whole list into unsorted_chunks.  */
 629         first(b) = last(b) = b;
 630         b = unsorted_chunks(&main_arena);
 631         ms->av[2*i+2]->bk = b;
 632         ms->av[2*i+3]->fd = b->fd;
 633         b->fd->bk = ms->av[2*i+3];
 634         b->fd = ms->av[2*i+2];
 635       }
 636     }
 637   }
 638   if (ms->version < 3) {
 639     /* Clear fd_nextsize and bk_nextsize fields.  */
 640     b = unsorted_chunks(&main_arena)->fd;
 641     while (b != unsorted_chunks(&main_arena)) {
 642       if (!in_smallbin_range(chunksize(b))) {
 643         b->fd_nextsize = NULL;
 644         b->bk_nextsize = NULL;
 645       }
 646       b = b->fd;
 647     }
 648   }
 649   mp_.sbrk_base = ms->sbrk_base;
 650   main_arena.system_mem = ms->sbrked_mem_bytes;
 651   mp_.trim_threshold = ms->trim_threshold;
 652   mp_.top_pad = ms->top_pad;
 653   mp_.n_mmaps_max = ms->n_mmaps_max;
 654   mp_.mmap_threshold = ms->mmap_threshold;
 655   check_action = ms->check_action;
 656   main_arena.max_system_mem = ms->max_sbrked_mem;
 657 #ifdef NO_THREADS
 658   mp_.max_total_mem = ms->max_total_mem;
 659 #endif
 660   mp_.n_mmaps = ms->n_mmaps;
 661   mp_.max_n_mmaps = ms->max_n_mmaps;
 662   mp_.mmapped_mem = ms->mmapped_mem;
 663   mp_.max_mmapped_mem = ms->max_mmapped_mem;
 664   /* add version-dependent code here */
 665   if (ms->version >= 1) {
 666     /* Check whether it is safe to enable malloc checking, or whether
 667        it is necessary to disable it.  */
 668     if (ms->using_malloc_checking && !using_malloc_checking &&
 669         !disallow_malloc_check)
 670       __malloc_check_init ();
 671     else if (!ms->using_malloc_checking && using_malloc_checking) {
 672       __malloc_hook = 0;
 673       __free_hook = 0;
 674       __realloc_hook = 0;
 675       __memalign_hook = 0;
 676       using_malloc_checking = 0;
 677     }
 678   }
 679   if (ms->version >= 4) {
 680 #ifdef PER_THREAD
 681     mp_.arena_test = ms->arena_test;
 682     mp_.arena_max = ms->arena_max;
 683     narenas = ms->narenas;
 684 #endif
 685   }
 686   check_malloc_state(&main_arena);
 687
 688   (void)mutex_unlock(&main_arena.mutex);
 689   return 0;
 690 }
 691
 692 /*
 693  * Local variables:
 694  * c-basic-offset: 2
 695  * End:
 696  */