--- ray/src/common/malloc.c	1991/11/12 16:54:29	2.1
+++ ray/src/common/malloc.c	1992/06/29 22:39:51	2.5
@@ -1,4 +1,4 @@
-/* Copyright (c) 1991 Regents of the University of California */
+/* Copyright (c) 1992 Regents of the University of California */
 
 #ifndef lint
 static char SCCSid[] = "$SunId$ LBL";
@@ -233,12 +233,14 @@ register unsigned  n;
 		pagesz = amnt = getpagesize();
 		nrem = (int)sbrk(0);			/* page align break */
 		nrem = pagesz - (nrem&(pagesz-1));
-		bpos = sbrk(nrem);			/* word aligned! */
+		bpos = sbrk(nrem);
 		if ((int)bpos == -1)
 			return(NULL);
 #ifdef MSTATS
 		b_nsbrked += nrem;
 #endif
+		bpos += nrem & (BYTES_WORD-1);		/* align pointer */
+		nrem &= ~(BYTES_WORD-1);
 	}
 
 	n = (n+(BYTES_WORD-1))&~(BYTES_WORD-1);		/* word align rqst. */
@@ -360,7 +362,7 @@ unsigned	n;
 	if (n <= on && (n > on>>1 || on == 1<<FIRSTBUCKET))
 		return(op);		/* same bucket */
 	if ((p = malloc(n)) == NULL)
-		return(NULL);
+		return(n<=on ? op : NULL);
 	if (on) {
 #ifdef  BSD
 		bcopy(op, p, n>on ? on : n);
@@ -379,12 +381,14 @@ char	*p;
 	register M_HEAD	*mp;
 	register int	bucket;
 
-	if (p == NULL || p == DUMMYLOC)
+	if (p == NULL | p == DUMMYLOC)
 		return(1);
 	mp = (M_HEAD *)p - 1;
 	if (mp->a.magic != MAGIC)		/* sanity check */
 		return(0);
 	bucket = mp->a.bucket;
+	if (bucket < FIRSTBUCKET | bucket >= NBUCKETS)
+		return(0);
 	mp->next = free_list[bucket];
 	free_list[bucket] = mp;
 #ifdef MSTATS