d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

lpr(1): small bounds check with reallocarray(3).

Browse Source 
While here plug a memory leak upon error and postpose a multiplication
until after reallocation has succeded.

Hinted partially by:	OpenBSD
Reviewed by:		gad
MFC after:		2 weeks
This commit is contained in:
Pedro F. Giffuni 2017-03-07 19:30:22 +00:00
parent 14984031b7
commit 4fd444b072
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=314877
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
usr.sbin/lpr/common_source/common.c
View File

@ -167,11 +167,13 @@ getq(const struct printer *pp, struct jobqueue *(*namelist[]))
* realloc the maximum size.
*/
if (++nitems > arraysz) {
arraysz *= 2;
queue = (struct jobqueue **)realloc((char *)queue,
arraysz * sizeof(struct jobqueue *));
if (queue == NULL)
queue = (struct jobqueue **)reallocarray((char *)queue,
arraysz, 2 * sizeof(struct jobqueue *));
if (queue == NULL) {
free(q);
goto errdone;
}
arraysz *= 2;
}
queue[nitems-1] = q;
}