security guarantee ;-)

Hi! I decided to give guarantee for alloc, which I suggested here.
http://62.44.100.74/programs/diet/alloc.tar.gz

Enjoy, Nikola


------------ Guarantee.txt ----- part of alloc.tar.gz -------------
The alloc security guarantee

I offer 200 Euro to the first person who publish a verifiable security
hole in the latest stable version of alloc package.

My judgment is final as to what constitutes a security hole in alloc.

I am not the author of alloc.c source.  I only made some changes.

md5sum alloc*.c
8b4c22057e8df0f48274ecb4a0178bce  alloc.c
0bbf48ea736ec4b1e038367a45b75343  alloc_calloc.c
2a421124516c2cd2685d749cfefc5e5d  alloc_free.c
f8edeeb49db3efac56d2a9416e4a2fe6  alloc_realloc.c

24 April 2009
Nikola


---------------------- The heart of alloc.c ----------------------
static void* REGPARM(1) __small_malloc(size_t size) {
  static __alloc_t *space[8];
  __alloc_t **idx=0, *ptr;
  size_t map_size=MEM_BLOCK_SIZE;

  if (size > __MAX_SMALL_SIZE) {
    map_size=size;

  get_mmap:
    ptr = mmap(0, map_size, PROT_READ|PROT_WRITE,
	       MAP_ANONYMOUS|MAP_PRIVATE, -1, (size_t)0);
    if (size > __MAX_SMALL_SIZE ||
	ptr==MAP_FAILED) return ptr;

    *idx = ptr;
    ptr->size = map_size;
    goto ready;
  }

  idx=__GET_INDEX(size);
  ptr=*idx;

  if (ptr) {	/* get a free block */
    *idx=ptr->next;
    ptr->next=0;
  } else {
    /* see: Algorithm.txt */
    for (idx=space; (ptr=*idx) && ptr->size < size;) idx++;
    if (ptr==0) goto get_mmap;

  ready:
    ptr->size -= size;
    if (ptr->size==0) {
      for (; idx < space+7; idx++) idx[0] = idx[1];
      *idx = 0;
    }
    ptr = (((void*)ptr) + ptr->size);
  }
  return ptr;
}