lpr(1): small bounds check with reallocarray(3).

While here plug a memory leak upon error and postpose a multiplication
until after reallocation has succeded.

Hinted partially by:	OpenBSD
Reviewed by:		gad
MFC after:		2 weeks
This commit is contained in:
Pedro F. Giffuni 2017-03-07 19:30:22 +00:00
parent 14984031b7
commit 4fd444b072

View File

@ -167,11 +167,13 @@ getq(const struct printer *pp, struct jobqueue *(*namelist[]))
* realloc the maximum size. * realloc the maximum size.
*/ */
if (++nitems > arraysz) { if (++nitems > arraysz) {
arraysz *= 2; queue = (struct jobqueue **)reallocarray((char *)queue,
queue = (struct jobqueue **)realloc((char *)queue, arraysz, 2 * sizeof(struct jobqueue *));
arraysz * sizeof(struct jobqueue *)); if (queue == NULL) {
if (queue == NULL) free(q);
goto errdone; goto errdone;
}
arraysz *= 2;
} }
queue[nitems-1] = q; queue[nitems-1] = q;
} }