libpam: extra bounds checking through reallocarray(3).

Reviewed by:	des
MFC after:	1 week
This commit is contained in:
Pedro F. Giffuni 2017-03-06 15:45:46 +00:00
parent fdd2f2ebdd
commit b5120bbada
Notes: svn2git 2020-12-20 02:59:44 +00:00
svn path=/head/; revision=314780

View File

@ -138,7 +138,7 @@ _pam_exec(pam_handle_t *pamh __unused,
nitems = sizeof(env_items) / sizeof(*env_items);
/* Count PAM return values put in the environment. */
nitems_rv = options->return_prog_exit_status ? PAM_RV_COUNT : 0;
tmp = realloc(envlist, (envlen + nitems + 1 + nitems_rv + 1) *
tmp = reallocarray(envlist, envlen + nitems + 1 + nitems_rv + 1,
sizeof(*envlist));
if (tmp == NULL) {
openpam_free_envlist(envlist);