d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

When (re)allocating space for an array of pointers to char, use

Browse Source 
sizeof(*list), not sizeof(**list).  (i.e., sizeof(pointer) rather than
sizeof(char)).

It is possible that this buffer overflow is exploitable, but it was
added after RELENG_5 forked and hasn't been MFCed, so this will not
receive an advisory.

Submitted by:	Vitezslav Novy
MFC after:	1 day
This commit is contained in:
Colin Percival 2005-09-19 18:43:11 +00:00
parent e26a9b9fff
commit 25284732cd
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/libpam/modules/pam_exec/pam_exec.c
View File

@ -83,7 +83,7 @@ _pam_exec(pam_handle_t *pamh __unused, int flags __unused,
for (envlen = 0; envlist[envlen] != NULL; ++envlen)
/* nothing */ ;
nitems = sizeof(env_items) / sizeof(*env_items);
tmp = realloc(envlist, (envlen + nitems + 1) * sizeof **envlist);
tmp = realloc(envlist, (envlen + nitems + 1) * sizeof(*envlist));
if (tmp == NULL) {
openpam_free_envlist(envlist);
return (PAM_BUF_ERR);