malloc: tcache: Validate tc_idx before checking for double-frees [BZ #23907]

The previous check could read beyond the end of the tcache entry
array.  If the e->key == tcache cookie check happened to pass, this
would result in crashes.

1 files changed, 6 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 77fb773aea..84ddd68d7d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2018-11-26  Florian Weimer  <fweimer@redhat.com>
+
+	[BZ #23907]
+	* malloc/malloc.c (_int_free): Validate tc_idx before checking for
+	double-frees.
+
 2018-11-26  Rafael Ávila de Espíndola  <rafael@espindo.la>
 
 	[BZ #19767]