delint; original from deraadt@ with fixes from tdeval@ and me;

tested by quite a few developers. ok deraadt@

1 files changed, 60 insertions, 43 deletions

diff --git a/src/lib/libc/stdlib/malloc.c b/src/lib/libc/stdlib/malloc.c
index e1e1831a94..4a38c53bbd 100644
--- a/src/lib/libc/stdlib/malloc.c
+++ b/src/lib/libc/stdlib/malloc.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: malloc.c,v 1.80 2006/02/14 11:14:11 espie Exp $       */
+/*      $OpenBSD: malloc.c,v 1.81 2006/04/18 18:26:13 otto Exp $        */
 
 /*
  * ----------------------------------------------------------------------------
@@ -114,7 +114,7 @@ struct pgfree {
 #define MALLOC_MAGIC    ((struct pginfo*) 4)
 
 #ifndef malloc_minsize
-#define malloc_minsize                  16U
+#define malloc_minsize                  16UL
 #endif
 
 #if !defined(malloc_pagesize)
@@ -189,8 +189,8 @@ static int	malloc_realloc;
 static int      malloc_freeprot;
 
 /* use guard pages after allocations? */
-static int      malloc_guard = 0;
-static int      malloc_guarded;
+static size_t   malloc_guard = 0;
+static size_t   malloc_guarded;
 /* align pointers to end of page? */
 static int      malloc_ptrguard;
 
@@ -231,7 +231,7 @@ static int	malloc_active;
 static size_t   malloc_used;
 
 /* My last break. */
-static void     *malloc_brk;
+static caddr_t  malloc_brk;
 
 /* One location cache for free-list holders. */
 static struct pgfree *px;
@@ -310,14 +310,14 @@ malloc_dump(int fd)
         struct pginfo   **pd;
         struct pgfree   *pf;
         struct pdinfo   *pi;
-        int             j;
+        u_long          j;
 
         pd = page_dir;
         pi = (struct pdinfo *) ((caddr_t) pd + pdi_off);
 
         /* print out all the pages */
         for (j = 0; j <= last_index;) {
-                snprintf(buf, sizeof buf, "%08lx %5d ", j << malloc_pageshift, j);
+                snprintf(buf, sizeof buf, "%08lx %5lu ", j << malloc_pageshift, j);
                 write(fd, buf, strlen(buf));
                 if (pd[PI_OFF(j)] == MALLOC_NOT_MINE) {
                         for (j++; j <= last_index && pd[PI_OFF(j)] == MALLOC_NOT_MINE;) {
@@ -330,7 +330,7 @@ malloc_dump(int fd)
                                 }
                         }
                         j--;
-                        snprintf(buf, sizeof buf, ".. %5d not mine\n", j);
+                        snprintf(buf, sizeof buf, ".. %5lu not mine\n", j);
                         write(fd, buf, strlen(buf));
                 } else if (pd[PI_OFF(j)] == MALLOC_FREE) {
                         for (j++; j <= last_index && pd[PI_OFF(j)] == MALLOC_FREE;) {
@@ -343,7 +343,7 @@ malloc_dump(int fd)
                                 }
                         }
                         j--;
-                        snprintf(buf, sizeof buf, ".. %5d free\n", j);
+                        snprintf(buf, sizeof buf, ".. %5lu free\n", j);
                         write(fd, buf, strlen(buf));
                 } else if (pd[PI_OFF(j)] == MALLOC_FIRST) {
                         for (j++; j <= last_index && pd[PI_OFF(j)] == MALLOC_FOLLOW;) {
@@ -356,7 +356,7 @@ malloc_dump(int fd)
                                 }
                         }
                         j--;
-                        snprintf(buf, sizeof buf, ".. %5d in use\n", j);
+                        snprintf(buf, sizeof buf, ".. %5lu in use\n", j);
                         write(fd, buf, strlen(buf));
                 } else if (pd[PI_OFF(j)] < MALLOC_MAGIC) {
                         snprintf(buf, sizeof buf, "(%p)\n", pd[PI_OFF(j)]);
@@ -378,7 +378,7 @@ malloc_dump(int fd)
 
         for (pf = free_list.next; pf; pf = pf->next) {
                 snprintf(buf, sizeof buf, "Free: @%p [%p...%p[ %ld ->%p <-%p\n",
-                    pf, pf->page, pf->page + pf->size,
+                    pf, pf->page, (char *)pf->page + pf->size,
                     pf->size, pf->prev, pf->next);
                 write(fd, buf, strlen(buf));
                 if (pf == pf->next) {
@@ -389,13 +389,13 @@ malloc_dump(int fd)
         }
 
         /* print out various info */
-        snprintf(buf, sizeof buf, "Minsize\t%d\n", malloc_minsize);
+        snprintf(buf, sizeof buf, "Minsize\t%lu\n", malloc_minsize);
         write(fd, buf, strlen(buf));
-        snprintf(buf, sizeof buf, "Maxsize\t%d\n", malloc_maxsize);
+        snprintf(buf, sizeof buf, "Maxsize\t%lu\n", malloc_maxsize);
         write(fd, buf, strlen(buf));
-        snprintf(buf, sizeof buf, "Pagesize\t%lu\n", (u_long) malloc_pagesize);
+        snprintf(buf, sizeof buf, "Pagesize\t%lu\n", malloc_pagesize);
         write(fd, buf, strlen(buf));
-        snprintf(buf, sizeof buf, "Pageshift\t%d\n", malloc_pageshift);
+        snprintf(buf, sizeof buf, "Pageshift\t%u\n", malloc_pageshift);
         write(fd, buf, strlen(buf));
         snprintf(buf, sizeof buf, "In use\t%lu\n", (u_long) malloc_used);
         write(fd, buf, strlen(buf));
@@ -485,7 +485,7 @@ map_pages(size_t pages)
         struct pdinfo   *pi, *spi;
         struct pginfo   **pd;
         u_long          idx, pidx, lidx;
-        void            *result, *tail;
+        caddr_t         result, tail;
         u_long          index, lindex;
 
         pages <<= malloc_pageshift;
@@ -517,7 +517,7 @@ map_pages(size_t pages)
                 if (pi == NULL || PD_IDX(pi->dirnum) != idx) {
                         if ((pd = MMAP(malloc_pagesize)) == MAP_FAILED) {
                                 errno = ENOMEM;         /* XXX */
-                                munmap(result, tail - result);
+                                munmap(result, (size_t)(tail - result));
 #ifdef MALLOC_EXTRA_SANITY
                                 wrtwarning("(ES): map_pages fails");
 #endif /* MALLOC_EXTRA_SANITY */
@@ -528,7 +528,8 @@ map_pages(size_t pages)
                         pi->base = pd;
                         pi->prev = spi;
                         pi->next = spi->next;
-                        pi->dirnum = idx * (malloc_pagesize / sizeof(struct pginfo *));
+                        pi->dirnum = idx * (malloc_pagesize /
+                            sizeof(struct pginfo *));
 
                         if (spi->next != NULL)
                                 spi->next->prev = pi;
@@ -538,7 +539,8 @@ map_pages(size_t pages)
                         pi->dirnum += pdi_mod;
                 } else if (idx == pidx) {
                         if (pidx == lidx) {
-                                pi->dirnum += (tail - result) >> malloc_pageshift;
+                                pi->dirnum += (u_long)(tail - result) >>
+                                    malloc_pageshift;
                         } else {
                                 pi->dirnum += pdi_mod - PI_OFF(index);
                         }
@@ -927,9 +929,12 @@ malloc_make_chunks(int bits)
 {
         struct pginfo   *bp, **pd;
         struct pdinfo   *pi;
+#ifdef  MALLOC_EXTRA_SANITY
         u_long          pidx;
+#endif  /* MALLOC_EXTRA_SANITY */
         void            *pp;
-        int             i, k, l;
+        long            i, k;
+        size_t          l;
 
         /* Allocate a new bucket */
         pp = malloc_pages((size_t) malloc_pagesize);
@@ -987,26 +992,27 @@ malloc_make_chunks(int bits)
         i = 0;
 
         /* Do a bunch at a time */
-        for (; k - i >= MALLOC_BITS; i += MALLOC_BITS)
+        for (; (k - i) >= MALLOC_BITS; i += MALLOC_BITS)
                 bp->bits[i / MALLOC_BITS] = ~0UL;
 
         for (; i < k; i++)
                 bp->bits[i / MALLOC_BITS] |= 1UL << (i % MALLOC_BITS);
 
+        k = (long)l;
         if (bp == bp->page) {
                 /* Mark the ones we stole for ourselves */
-                for (i = 0; l > 0; i++) {
+                for (i = 0; k > 0; i++) {
                         bp->bits[i / MALLOC_BITS] &= ~(1UL << (i % MALLOC_BITS));
                         bp->free--;
                         bp->total--;
-                        l -= (1 << bits);
+                        k -= (1 << bits);
                 }
         }
         /* MALLOC_LOCK */
 
-        pidx = PI_IDX(ptr2index(pp));
         pdir_lookup(ptr2index(pp), &pi);
 #ifdef MALLOC_EXTRA_SANITY
+        pidx = PI_IDX(ptr2index(pp));
         if (pi == NULL || PD_IDX(pi->dirnum) != pidx) {
                 wrterror("(ES): mapped pages not found in directory");
                 errno = EFAULT;
@@ -1033,7 +1039,8 @@ malloc_make_chunks(int bits)
 static void *
 malloc_bytes(size_t size)
 {
-        int             i, j, k;
+        int             i, j;
+        size_t          k;
         u_long          u, *lp;
         struct pginfo   *bp;
 
@@ -1103,7 +1110,7 @@ malloc_bytes(size_t size)
         k <<= bp->shift;
 
         if (malloc_junk && bp->size != 0)
-                memset((char *) bp->page + k, SOME_JUNK, bp->size);
+                memset((char *)bp->page + k, SOME_JUNK, (size_t)bp->size);
 
         return ((u_char *) bp->page + k);
 }
@@ -1160,11 +1167,14 @@ static void *
 irealloc(void *ptr, size_t size)
 {
         void            *p;
-        u_long          osize, index, i;
+        size_t          osize;
+        u_long          index, i;
         struct pginfo   **mp;
         struct pginfo   **pd;
         struct pdinfo   *pi;
+#ifdef  MALLOC_EXTRA_SANITY
         u_long          pidx;
+#endif  /* MALLOC_EXTRA_SANITY */
 
         if (suicide)
                 abort();
@@ -1193,9 +1203,9 @@ irealloc(void *ptr, size_t size)
                 wrtwarning("junk pointer, too high to make sense");
                 return (NULL);
         }
-        pidx = PI_IDX(index);
         pdir_lookup(index, &pi);
 #ifdef MALLOC_EXTRA_SANITY
+        pidx = PI_IDX(index);
         if (pi == NULL || PD_IDX(pi->dirnum) != pidx) {
                 wrterror("(ES): mapped pages not found in directory");
                 errno = EFAULT;
@@ -1293,11 +1303,12 @@ irealloc(void *ptr, size_t size)
 static __inline__ void
 free_pages(void *ptr, u_long index, struct pginfo * info)
 {
-        u_long          i, l, cachesize = 0, pidx, lidx;
+        u_long          i, pidx, lidx;
+        size_t          l, cachesize = 0;
         struct pginfo   **pd;
         struct pdinfo   *pi, *spi;
         struct pgfree   *pf, *pt = NULL;
-        void            *tail;
+        caddr_t         tail;
 
         if (info == MALLOC_FREE) {
                 wrtwarning("page is already free");
@@ -1364,7 +1375,7 @@ free_pages(void *ptr, u_long index, struct pginfo * info)
                 pd[PI_OFF(index + i)] = MALLOC_FREE;
                 l += malloc_guard;
         }
-        tail = (char *) ptr + l;
+        tail = (caddr_t)ptr + l;
 
         if (malloc_hint)
                 madvise(ptr, l, MADV_FREE);
@@ -1394,7 +1405,8 @@ free_pages(void *ptr, u_long index, struct pginfo * info)
 
                 /* Race ahead here, while calculating cache size. */
                 for (pf = free_list.next;
-                    pf->page + pf->size < ptr && pf->next != NULL;
+                    (caddr_t)ptr > ((caddr_t)pf->page + pf->size)
+                    && pf->next != NULL;
                     pf = pf->next)
                         cachesize += pf->size;
 
@@ -1405,7 +1417,7 @@ free_pages(void *ptr, u_long index, struct pginfo * info)
                         pt = pt->next;
                 }
 
-                if (pf->page > tail) {
+                if ((caddr_t)pf->page > tail) {
                         /* Insert before entry */
                         px->next = pf;
                         px->prev = pf->prev;
@@ -1413,12 +1425,12 @@ free_pages(void *ptr, u_long index, struct pginfo * info)
                         px->prev->next = px;
                         pf = px;
                         px = NULL;
-                } else if ((pf->page + pf->size) == ptr) {
+                } else if (((caddr_t)pf->page + pf->size) == ptr) {
                         /* Append to the previous entry. */
                         cachesize -= pf->size;
                         pf->size += l;
                         if (pf->next != NULL &&
-                            pf->page + pf->size == pf->next->page) {
+                            pf->next->page == ((caddr_t)pf->page + pf->size)) {
                                 /* And collapse the next too. */
                                 pt = pf->next;
                                 pf->size += pt->size;
@@ -1461,11 +1473,11 @@ free_pages(void *ptr, u_long index, struct pginfo * info)
                 if (munmap((char *) pf->page + (malloc_cache - cachesize),
                     pf->size - (malloc_cache - cachesize)) != 0)
                         goto not_return;
-                tail = pf->page + pf->size;
+                tail = (caddr_t)pf->page + pf->size;
                 lidx = ptr2index(tail) - 1;
                 pf->size = malloc_cache - cachesize;
 
-                index = ptr2index(pf->page + pf->size);
+                index = ptr2index((caddr_t)pf->page + pf->size);
 
                 pidx = PI_IDX(index);
                 if (prev_dir != NULL && PD_IDX(prev_dir->dirnum) >= pidx)
@@ -1594,13 +1606,15 @@ not_return:
 
 /* ARGSUSED */
 static __inline__ void
-free_bytes(void *ptr, int index, struct pginfo * info)
+free_bytes(void *ptr, u_long index, struct pginfo * info)
 {
         struct pginfo   **mp, **pd;
         struct pdinfo   *pi;
+#ifdef  MALLOC_EXTRA_SANITY
         u_long          pidx;
+#endif  /* MALLOC_EXTRA_SANITY */
         void            *vp;
-        int             i;
+        long            i;
 
         /* Find the chunk number on the page */
         i = ((u_long) ptr & malloc_pagemask) >> info->shift;
@@ -1614,7 +1628,7 @@ free_bytes(void *ptr, int index, struct pginfo * info)
                 return;
         }
         if (malloc_junk && info->size != 0)
-                memset(ptr, SOME_JUNK, info->size);
+                memset(ptr, SOME_JUNK, (size_t)info->size);
 
         info->bits[i / MALLOC_BITS] |= 1UL << (i % MALLOC_BITS);
         info->free++;
@@ -1652,9 +1666,9 @@ free_bytes(void *ptr, int index, struct pginfo * info)
         *mp = info->next;
 
         /* Free the page & the info structure if need be */
-        pidx = PI_IDX(ptr2index(info->page));
         pdir_lookup(ptr2index(info->page), &pi);
 #ifdef MALLOC_EXTRA_SANITY
+        pidx = PI_IDX(ptr2index(info->page));
         if (pi == NULL || PD_IDX(pi->dirnum) != pidx) {
                 wrterror("(ES): mapped pages not found in directory");
                 errno = EFAULT;
@@ -1682,7 +1696,10 @@ static void
 ifree(void *ptr)
 {
         struct pginfo   *info, **pd;
-        u_long          pidx, index;
+        u_long          index;
+#ifdef  MALLOC_EXTRA_SANITY
+        u_long          pidx;
+#endif  /* MALLOC_EXTRA_SANITY */
         struct pdinfo   *pi;
 
         if (!malloc_started) {
@@ -1708,9 +1725,9 @@ ifree(void *ptr)
                 wrtwarning("ifree: junk pointer, too high to make sense");
                 return;
         }
-        pidx = PI_IDX(index);
         pdir_lookup(index, &pi);
 #ifdef MALLOC_EXTRA_SANITY
+        pidx = PI_IDX(index);
         if (pi == NULL || PD_IDX(pi->dirnum) != pidx) {
                 wrterror("(ES): mapped pages not found in directory");
                 errno = EFAULT;