1 files changed, 27 insertions, 24 deletions

diff --git a/src/lib/libc/stdlib/malloc.c b/src/lib/libc/stdlib/malloc.c
index b3fa447ceb..9bdea862f2 100644
--- a/src/lib/libc/stdlib/malloc.c
+++ b/src/lib/libc/stdlib/malloc.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: malloc.c,v 1.122 2009/12/07 18:47:38 miod Exp $       */
+/*      $OpenBSD: malloc.c,v 1.123 2009/12/16 08:23:53 otto Exp $       */
 /*
  * Copyright (c) 2008 Otto Moerbeek <otto@drijf.net>
  *
@@ -66,7 +66,7 @@
 
 #define MALLOC_MAXCHUNK         (1 << (MALLOC_PAGESHIFT-1))
 #define MALLOC_MAXCACHE         256
-#define MALLOC_DELAYED_CHUNKS   16      /* should be power of 2 */
+#define MALLOC_DELAYED_CHUNKS   15      /* max of getrnibble() */
 /*
  * When the P option is active, we move allocations between half a page
  * and a whole page towards the end, subject to alignment constraints.
@@ -112,7 +112,7 @@ struct dir_info {
                                         /* free pages cache */
         struct region_info free_regions[MALLOC_MAXCACHE];
                                         /* delayed free chunk slots */
-        void *delayed_chunks[MALLOC_DELAYED_CHUNKS];
+        void *delayed_chunks[MALLOC_DELAYED_CHUNKS + 1];
 #ifdef MALLOC_STATS
         size_t inserts;
         size_t insert_collisions;
@@ -185,9 +185,9 @@ static int	malloc_active;		/* status of malloc */
 static size_t   malloc_guarded;         /* bytes used for guards */
 static size_t   malloc_used;            /* bytes allocated */
 
-static size_t rbytesused;               /* random bytes used */
+static size_t rnibblesused;             /* random nibbles used */
 static u_char rbytes[512];              /* random bytes */
-static u_char getrbyte(void);
+static u_char getrnibble(void);
 
 extern char     *__progname;
 
@@ -380,6 +380,24 @@ wrterror(char *p)
                 abort();
 }
 
+static void
+rbytes_init(void)
+{
+        arc4random_buf(rbytes, sizeof(rbytes));
+        rnibblesused = 0;
+}
+
+static inline u_char
+getrnibble(void)
+{
+        u_char x;
+
+        if (rnibblesused >= 2 * sizeof(rbytes))
+                rbytes_init();
+        x = rbytes[rnibblesused++ / 2];
+        return (rnibblesused & 1 ? x & 0xf : x >> 4);
+}
+
 /*
  * Cache maintenance. We keep at most malloc_cache pages cached.
  * If the cache is becoming full, unmap pages in the cache for real,
@@ -410,7 +428,7 @@ unmap(struct dir_info *d, void *p, size_t sz)
         rsz = mopts.malloc_cache - d->free_regions_size;
         if (psz > rsz)
                 tounmap = psz - rsz;
-        offset = getrbyte();
+        offset = getrnibble();
         for (i = 0; tounmap > 0 && i < mopts.malloc_cache; i++) {
                 r = &d->free_regions[(i + offset) & (mopts.malloc_cache - 1)];
                 if (r->p != NULL) {
@@ -491,7 +509,7 @@ map(struct dir_info *d, size_t sz, int zero_fill)
                 /* zero fill not needed */
                 return p;
         }
-        offset = getrbyte();
+        offset = getrnibble();
         for (i = 0; i < mopts.malloc_cache; i++) {
                 r = &d->free_regions[(i + offset) & (mopts.malloc_cache - 1)];
                 if (r->p != NULL) {
@@ -538,21 +556,6 @@ map(struct dir_info *d, size_t sz, int zero_fill)
         return p;
 }
 
-static void
-rbytes_init(void)
-{
-        arc4random_buf(rbytes, sizeof(rbytes));
-        rbytesused = 0;
-}
-
-static u_char
-getrbyte(void)
-{
-        if (rbytesused >= sizeof(rbytes))
-                rbytes_init();
-        return rbytes[rbytesused++];
-}
-
 /*
  * Initialize a dir_info, which should have been cleared by caller
  */
@@ -1012,7 +1015,7 @@ malloc_bytes(struct dir_info *d, size_t size)
         }
 
         /* advance a random # of positions */
-        i = (getrbyte() & (MALLOC_DELAYED_CHUNKS - 1)) % bp->free;
+        i = getrnibble() % bp->free;
         while (i > 0) {
                 u += u;
                 k++;
@@ -1275,7 +1278,7 @@ ofree(void *p)
                 if (mopts.malloc_junk && sz > 0)
                         memset(p, SOME_FREEJUNK, sz);
                 if (!mopts.malloc_freeprot) {
-                        i = getrbyte() & (MALLOC_DELAYED_CHUNKS - 1);
+                        i = getrnibble();
                         tmp = p;
                         p = g_pool->delayed_chunks[i];
                         g_pool->delayed_chunks[i] = tmp;