setting MALLOC_PERTURB_ in the env will take that number and initialize all malloc's with that value (and the inverse when freeing). this should be documented in malloc(3) (and noted in free(3)). e.g. if you set MALLOC_PERTURB_=123, glibc will do memset((123 ^ 0xff) & 0xff) when doing malloc(), and then glibc will do memset(123 & 0xff) when doing free()
Mike, Thanks for the heads-up on this. Looking closer, there are a bunch of these environment variables that are undocumented, and they're also closely related to the mallopt() library function, which is also undocumented. I think it would be best to document all of this stuff together, and best done on a mallopt(3) page, rather that in the existing malloc(3). (And yes, the MALLOC_TRACE_ info that is currently in mallopt(3) should probably also move to the to-be-created mallopt(3) page.) I'll get onto this. Thanks, Michael
man-pages-3.38 added mallopt(3) page which covers MALLOC_PERTURB_ and other malloc-related environment variables. With respect to mentions in malloc(3) and free(3), I've elected simply to use SEE ALSO. For 3.39, I've just fixed a small error in the discussion of M_PERTURB and free().