Use a separate segment for the sigaltstack

Having a stack on the heap just feels unclean, also this way we have a chance
to get a red zone adjacent to the mapping just in case we manage to overflow
the alt stack also.

Ref: #2396

bin/varnishd/mgt/mgt_child.c

@@ -85,6 +85,7 @@ static struct vlu	*child_std_vlu;
 static struct vsb *child_panic = NULL;
 
 #ifdef HAVE_SIGALTSTACK
+#include <sys/mman.h>
 stack_t altstack;
 #endif
 
@@ -372,7 +373,10 @@ mgt_launch_child(struct cli *cli)
 			size_t sz = SIGSTKSZ + 4096;
 			if (sz < mgt_param.wthread_stacksize)
 				sz = mgt_param.wthread_stacksize;
-			altstack.ss_sp = malloc(sz);
+			altstack.ss_sp = mmap(NULL, sz,  PROT_READ | PROT_WRITE,
+					      MAP_PRIVATE | MAP_ANONYMOUS,
+					      -1, 0);
+			AN(altstack.ss_sp != MAP_FAILED);
 			AN(altstack.ss_sp);
 			altstack.ss_size = sz;
 			altstack.ss_flags = 0;