diff options
| author |   doug <doug@openbsd.org> | 2014-10-11 03:08:26 +0000 |
|---|---|---|
| committer | doug <doug@openbsd.org> | 2014-10-11 03:08:26 +0000 |
| commit | ab30cb2f169c6d11f48e816e3ee96770c119963c (patch) | |
| tree | 20f6d91997aefdf627fb5faffaf82841c99a7fa1 | |
| parent | Userland reallocarray() audit. (diff) | |
| download | wireguard-openbsd-ab30cb2f169c6d11f48e816e3ee96770c119963c.tar.xz wireguard-openbsd-ab30cb2f169c6d11f48e816e3ee96770c119963c.zip | |
Userland reallocarray() audit.
Avoid potential integer overflow in the size argument of malloc() and
realloc() by using reallocarray() to avoid unchecked multiplication.
ok deraadt@
| -rw-r--r-- | sbin/disklabel/editor.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sbin/disklabel/editor.c b/sbin/disklabel/editor.c index 28da5e4f34b..f323e623db5 100644 --- a/sbin/disklabel/editor.c +++ b/sbin/disklabel/editor.c @@ -1,4 +1,4 @@ -/* $OpenBSD: editor.c,v 1.287 2014/07/10 13:31:23 florian Exp $ */ +/* $OpenBSD: editor.c,v 1.288 2014/10/11 03:08:26 doug Exp $ */ /* * Copyright (c) 1997-2000 Todd C. Miller <Todd.Miller@courtesan.com> @@ -567,7 +567,7 @@ again: memcpy(lp, lp_org, sizeof(struct disklabel)); lp->d_npartitions = MAXPARTITIONS; lastalloc = alloc_table[index].sz; - alloc = malloc(lastalloc * sizeof(struct space_allocation)); + alloc = reallocarray(NULL, lastalloc, sizeof(struct space_allocation)); if (alloc == NULL) errx(4, "out of memory"); memcpy(alloc, alloc_table[index].table, |