From 41daf65553f5dbf75d4593e6931f2d1dbabefbe0 Mon Sep 17 00:00:00 2001
From: otto <>
Date: Fri, 7 Oct 2016 12:59:04 +0000
Subject: [PATCH] document "chunk canary corrupted" error

---
 src/lib/libc/stdlib/malloc.3 | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/lib/libc/stdlib/malloc.3 b/src/lib/libc/stdlib/malloc.3
index 3ccd13cd..638bcc2b 100644
--- a/src/lib/libc/stdlib/malloc.3
+++ b/src/lib/libc/stdlib/malloc.3
@@ -30,9 +30,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"	$OpenBSD: malloc.3,v 1.95 2016/04/03 09:31:45 otto Exp $
+.\"	$OpenBSD: malloc.3,v 1.96 2016/10/07 12:59:04 otto Exp $
 .\"
-.Dd $Mdocdate: April 3 2016 $
+.Dd $Mdocdate: October 7 2016 $
 .Dt MALLOC 3
 .Os
 .Sh NAME
@@ -377,6 +377,11 @@ The pointer passed to
 or
 .Fn reallocarray
 has been modified.
+.It Dq chunk canary corrupted 0xhhhhllll
+A byte after the requested size has been overwritten,
+indicating a heap overflow.
+The high word is the length of the chunk,
+the low word is the offset at which corruption was detected.
 .It Dq recursive call
 An attempt was made to call recursively into these functions, i.e., from a
 signal handler.