free() boundary checking

[Paul Keogh]

I had a problem recently with a large application which supports the standard
shell globbing characters. The code for the globbing support was almost
exclusively lifted from the csh source. Under certain conditions, the         
application would crash on the next malloc call after the globbing operations.

Inspection of the code showed that a block freeing routine in the code called
free() whereas the equivalent csh code called a routine called xfree().  

xfree(c)
char *c;
{
	extern char end[];

	if (c >= end && c < (char *) &c)
		free(c);
}

I put this code into my application and the problem disappeared. 

Why is this check necessary ? Does the fix indicate that a previous malloc
/free operation was invalid ?.Opinions please.

Thanx,
Paul Keogh.
keogh at u.nix.ie