Critical fixes on bitmap_malloc() and bitmap_free()

src/bitmap/bitmap_free.c

@@ -94,7 +94,9 @@ void bitmap_free(raw_block_header_t *raw_block, void *ptr) {
     raw_block->dmm_stats.num_free++;
 #endif /* WITH_RAWBLOCK_STATS */
 
-    cell_no = ((char *)chunk_header - ((char *)rb_header + sizeof(bitmap_rb_t)))
+    cell_no = ((char *)chunk_header -
+            ((char *)rb_header + sizeof(bitmap_rb_t) + 
+             (rb_header->elements - 1) * BMAP_EL_SIZE))
         / rb_header->bytes_per_cell;
 
     bmap_index = cell_no / BMAP_EL_SIZE_BITS;

src/bitmap/bitmap_malloc.c

@@ -105,7 +105,7 @@ void * bitmap_malloc(raw_block_header_t *raw_block, size_t req_size) {
             // Calculate the pointer to the chunk to be retrieved
             chunk_address = (chunk_header_t *)((char *)rb_header +
                     sizeof(bitmap_rb_t) +
-                    rb_header->elements * BMAP_EL_SIZE +
+                    (rb_header->elements - 1) * BMAP_EL_SIZE +
                     (i * BMAP_EL_SIZE_BITS + found - 1) *
                     rb_header->bytes_per_cell);
             chunk_address->num_of_cells = cells;