unmapping of freed allocations without disabling chunk randomisation
like the "Freeguard" ('F') option does. Make security 'S' option
use 'U' and not 'F'.
Rationale: guarding with no chunk randomisation is great for debugging
use-after-free, but chunk randomisation offers better defence against
"heap feng shui" style attacks that depend on carefully constructing a
particular heap layout so we should leave this enabled when requesting
security options.

jasper@

a section will help people looking for just the MALLOC_OPTIONS.
ok otto@ jmc@

to exist before exit for malloc to dump stats in it.
tweaks from jmc@
ok otto@,jmc@

brad and millert, with hints from guenther, jmc, and otto I think.
ok previous.

extra safeguard (FGJ). Idea from deraadt@; ok deraadt@ dlg@

(MALLOC_OPTIONS=L). It was too slow to turn on by default, and we
don't do optional security.
requested by deraadt@ grumbling ok otto@

Move all runtime options into a structure that is made read-only
(via mprotect) after initialisation to protect against attacks that
overwrite options to turn off malloc protections (e.g. use-after-free)
Allocate the main bookkeeping data (struct dir_info) using mmap(),
thereby giving it an unpredictable address. Place a PROT_NONE guard
page on either side to further frustrate attacks on it.
Add a new 'L' option that maps struct dir_info PROT_NONE except when
in the allocator code itself. Makes attacks on it basically impossible.
feedback tedu deraadt otto canacar
ok otto

the page as possible (i.e. make malloc option P a default).
ok art@ millert@ krw@

ok jmc@

costs; ok jmc@ for the man page bits; ok millert@ deraadt@

Based on a diff from Mike Belopuhov.  OK jmc@

descriptive while at it, input and okay jmc@

remove redundant check on size. ok millert@ deraadt@

or if malloc must be used suggest check.
Get rid of "one".
OK deraadt@ and jmc@, OK kjell@ to earlier version with "one"s.

"yes, that is correct." jmc@ (a while back)

- break long lines
ok jmc

should be generally usable, split this out into option 'P'. ok deraadt

from kjell@

kill a .Pp before a display;

page after each page size allocation to detect overrun.  this is
somewhat electric fence like, while attempting to be mostly usable in
production.  also, use tdeval's chunk randomization code.
enabled with the G option.
ok deraadt and co.

this effect.  OK deraadt@ pvalchev@

the allocation.  ok deraadt@ markus@

rescinded 22 July 1999.  Proofed by myself and Theo.

- merge COMPATIBILITY
- kill whitespace at EOL

have it. We don't even have the directory /usr/share/doc/papers.
ok millert@.

ok deraadt@