diff options
| author |   doug <doug@openbsd.org> | 2014-10-11 04:06:05 +0000 |
|---|---|---|
| committer | doug <doug@openbsd.org> | 2014-10-11 04:06:05 +0000 |
| commit | 6895fd506adcde492d1eb40e5c321f99956f3c35 (patch) | |
| tree | 195f273f188c24f0e4352872254b04b7ca458167 | |
| parent | use reallocarray, and avoid this << 1 ugliness. (diff) | |
| download | wireguard-openbsd-6895fd506adcde492d1eb40e5c321f99956f3c35.tar.xz wireguard-openbsd-6895fd506adcde492d1eb40e5c321f99956f3c35.zip | |
Userland reallocarray() audit.
Avoid potential integer overflow in the size argument of malloc() and
realloc() by using reallocarray() to avoid unchecked multiplication.
ok deraadt@
| -rw-r--r-- | games/hunt/hunt/list.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/games/hunt/hunt/list.c b/games/hunt/hunt/list.c index 6be6b7edc21..4e4776938ec 100644 --- a/games/hunt/hunt/list.c +++ b/games/hunt/hunt/list.c @@ -1,4 +1,4 @@ -/* $OpenBSD: list.c,v 1.5 2007/09/04 22:39:31 hshoexer Exp $ */ +/* $OpenBSD: list.c,v 1.6 2014/10/11 04:06:05 doug Exp $ */ /* * Copyright 2001, David Leonard. All rights reserved. * Redistribution and use in source and binary forms with or without @@ -103,8 +103,9 @@ next_driver_fd(fd) if (numdrivers >= maxdrivers) { if (maxdrivers) { + drivers = reallocarray(drivers, maxdrivers, + 2 * sizeof(*driver)); maxdrivers *= 2; - drivers = realloc(drivers, sizeof *driver * maxdrivers); } else { maxdrivers = 16; drivers = calloc(sizeof *driver, maxdrivers); |