libfetch: extra bounds checking through reallocarray(3).

Reviewed by: des MFC after: 1 week
2017-03-06 15:37:34 +00:00 · 2017-03-06 15:37:34 +00:00 · bb7d0109d7
commit bb7d0109d7
parent def277d3ef
1 changed files with 1 additions and 1 deletions
--- a/lib/libpam/modules/pam_exec/pam_exec.c
+++ b/lib/libpam/modules/pam_exec/pam_exec.c
@ -138,7 +138,7 @@ _pam_exec(pam_handle_t *pamh __unused,
 	nitems = sizeof(env_items) / sizeof(*env_items);
 	/* Count PAM return values put in the environment. */
 	nitems_rv = options->return_prog_exit_status ? PAM_RV_COUNT : 0;
-	tmp = realloc(envlist, (envlen + nitems + 1 + nitems_rv + 1) *
+	tmp = reallocarray(envlist, envlen + nitems + 1 + nitems_rv + 1,
 	    sizeof(*envlist));
 	if (tmp == NULL) {
 		openpam_free_envlist(envlist);