Replace xrealloc() with xreallocarray(). Break-out the 'log and die'

function as xmallocfailure() and use that in the locations where
reallocarray's checks alone aren't sufficient.

ok doug@ deraadt@

8 files changed, 53 insertions, 57 deletions

diff --git a/usr.sbin/amd/amd/afs_ops.c b/usr.sbin/amd/amd/afs_ops.c
index fc54997ebd6..79e5c639c10 100644
--- a/usr.sbin/amd/amd/afs_ops.c
+++ b/usr.sbin/amd/amd/afs_ops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: afs_ops.c,v 1.14 2014/10/20 06:55:59 guenther Exp $	*/
+/*	$OpenBSD: afs_ops.c,v 1.15 2014/10/26 01:16:48 guenther Exp $	*/
 
 /*
  * Copyright (c) 1990 Jan-Simon Pendry
@@ -1418,7 +1418,7 @@ in_progrss:
 			 * otherwise just use these defaults.
 			 */
 			if (*auto_opts && *dfl) {
-				char *nopts = (char *) xmalloc(strlen(auto_opts)+strlen(dfl)+2);
+				char *nopts = xmalloc(strlen(auto_opts)+strlen(dfl)+2);
 				snprintf(nopts,
 				    strlen(auto_opts) + strlen(dfl) + 2,
 				    "%s;%s", dfl, auto_opts);
diff --git a/usr.sbin/amd/amd/host_ops.c b/usr.sbin/amd/amd/host_ops.c
index 4d8385bf2ba..571e714a81f 100644
--- a/usr.sbin/amd/amd/host_ops.c
+++ b/usr.sbin/amd/amd/host_ops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: host_ops.c,v 1.15 2014/10/20 06:55:59 guenther Exp $	*/
+/*	$OpenBSD: host_ops.c,v 1.16 2014/10/26 01:16:48 guenther Exp $	*/
 
 /*
  * Copyright (c) 1990 Jan-Simon Pendry
@@ -296,7 +296,7 @@ host_fmount(mntfs *mf)
 	 * so that they can be sorted.  If the filesystem
 	 * is already mounted then ignore it.
 	 */
-	ep = (exports *) xmalloc(n_export * sizeof(exports));
+	ep = xreallocarray(NULL, n_export, sizeof *ep);
 	for (j = 0, ex = exlist; ex; ex = ex->ex_next) {
 		MAKE_MNTPT(mntpt, ex, mf);
 		if (!already_mounted(mlist, mntpt))
@@ -315,7 +315,7 @@ host_fmount(mntfs *mf)
 	/*
 	 * Allocate an array of filehandles
 	 */
-	fp = (fhstatus *) xmalloc(n_export * sizeof(fhstatus));
+	fp = xreallocarray(NULL, n_export, sizeof *fp);
 
 	/*
 	 * Try to obtain filehandles for each directory.
diff --git a/usr.sbin/amd/amd/map.c b/usr.sbin/amd/amd/map.c
index 187adbf8613..d3c59e62ddd 100644
--- a/usr.sbin/amd/amd/map.c
+++ b/usr.sbin/amd/amd/map.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: map.c,v 1.10 2009/10/27 23:59:50 deraadt Exp $	*/
+/*	$OpenBSD: map.c,v 1.11 2014/10/26 01:16:48 guenther Exp $	*/
 
 /*-
  * Copyright (c) 1990 Jan-Simon Pendry
@@ -105,7 +105,7 @@ exported_ap_realloc_map(int nsize)
 	if (nsize < 0 || nsize == exported_ap_size)
 		return 0;
 
-	exported_ap = (am_node **) xrealloc((void *)exported_ap, nsize * sizeof(am_node*));
+	exported_ap = xreallocarray(exported_ap, nsize, sizeof *exported_ap);
 
 	if (nsize > exported_ap_size)
 		bzero((char *) (exported_ap+exported_ap_size),
diff --git a/usr.sbin/amd/amd/nfs_ops.c b/usr.sbin/amd/amd/nfs_ops.c
index d155c3d3f8f..9ea9cf3aab5 100644
--- a/usr.sbin/amd/amd/nfs_ops.c
+++ b/usr.sbin/amd/amd/nfs_ops.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nfs_ops.c,v 1.21 2014/10/20 06:55:59 guenther Exp $	*/
+/*	$OpenBSD: nfs_ops.c,v 1.22 2014/10/26 01:16:48 guenther Exp $	*/
 
 /*-
  * Copyright (c) 1990 Jan-Simon Pendry
@@ -401,7 +401,7 @@ nfs_match(am_opts *fo)
 	/*
 	 * Determine magic cookie to put in mtab
 	 */
-	xmtab = (char *) xmalloc(strlen(fo->opt_rhost) + strlen(fo->opt_rfs) + 2);
+	xmtab = xmalloc(strlen(fo->opt_rhost) + strlen(fo->opt_rfs) + 2);
 	snprintf(xmtab, strlen(fo->opt_rhost) + strlen(fo->opt_rfs) + 2,
 		"%s:%s", fo->opt_rhost, fo->opt_rfs);
 #ifdef DEBUG
diff --git a/usr.sbin/amd/amd/nfsx_ops.c b/usr.sbin/amd/amd/nfsx_ops.c
index 79b8303777c..cc8f901ca33 100644
--- a/usr.sbin/amd/amd/nfsx_ops.c
+++ b/usr.sbin/amd/amd/nfsx_ops.c
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)nfsx_ops.c	8.1 (Berkeley) 6/6/93
- *	$Id: nfsx_ops.c,v 1.6 2003/06/02 23:36:51 millert Exp $
+ *	$Id: nfsx_ops.c,v 1.7 2014/10/26 01:16:48 guenther Exp $
  */
 
 #include "am.h"
@@ -106,7 +106,9 @@ nfsx_match(am_opts *fo)
 	 * Bump string length to allow trailing /
 	 */
 	len = strlen(fo->opt_fs);
-	fo->opt_fs = xrealloc(fo->opt_fs, len + 1 + 1);
+	if (len > SIZE_MAX - 2)
+		 xmallocfailure();
+	fo->opt_fs = xreallocarray(fo->opt_fs, len + 1 + 1, 1);
 	ptr = fo->opt_fs + len;
 	/*
 	 * Make unique...
@@ -189,7 +191,7 @@ nfsx_init(mntfs *mf)
 		mf->mf_prfree = nfsx_prfree;
 
 		nx->nx_c = i - 1;	/* i-1 because we don't want the prefix */
-		nx->nx_v = (nfsx_mnt *) xmalloc(nx->nx_c * sizeof(nfsx_mnt));
+		nx->nx_v = xreallocarray(NULL, nx->nx_c, sizeof *nx->nx_v);
 		{ char *mp = 0;
 		  char *xinfo = 0;
 		  char *fs = mf->mf_fo->opt_fs;
diff --git a/usr.sbin/amd/amd/util.c b/usr.sbin/amd/amd/util.c
index 3dfe494b02a..be275d53fe6 100644
--- a/usr.sbin/amd/amd/util.c
+++ b/usr.sbin/amd/amd/util.c
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)util.c	8.1 (Berkeley) 6/6/93
- *	$Id: util.c,v 1.13 2014/10/20 02:33:42 guenther Exp $
+ *	$Id: util.c,v 1.14 2014/10/26 01:16:48 guenther Exp $
  */
 
 /*
@@ -49,7 +49,7 @@
 char *
 strnsave(const char *str, int len)
 {
-	char *sp = (char *) xmalloc(len+1);
+	char *sp = xmalloc(len+1);
 
 	bcopy(str, sp, len);
 	sp[len] = 0;
@@ -64,10 +64,13 @@ strnsave(const char *str, int len)
 char *
 str3cat(char *p, char *s1, char *s2, char *s3)
 {
-	int l1 = strlen(s1);
-	int l2 = strlen(s2);
-	int l3 = strlen(s3);
-	p = (char *) xrealloc(p, l1 + l2 + l3 + 1);
+	size_t l1 = strlen(s1);
+	size_t l2 = strlen(s2);
+	size_t l3 = strlen(s3);
+
+	if (l1 > SIZE_MAX - l2 || l1 + l2 > SIZE_MAX - l3)
+		 xmallocfailure();
+	p = xreallocarray(p, l1 + l2 + l3 + 1, 1);
 	bcopy(s1, p, l1);
 	bcopy(s2, p + l1, l2);
 	bcopy(s3, p + l1 + l2, l3 + 1);
@@ -77,9 +80,11 @@ str3cat(char *p, char *s1, char *s2, char *s3)
 char *
 strealloc(char *p, char *s)
 {
-	int len = strlen(s) + 1;
+	size_t len = strlen(s) + 1;
 
-	p = (char *) xrealloc((void *)p, len);
+	if (len > SIZE_MAX - 1)
+		 xmallocfailure();
+	p = xreallocarray(p, len, 1);
 
 	strlcpy(p, s, len);
 #ifdef DEBUG_MEM
@@ -95,7 +100,7 @@ strsplit(char *s, int ch, int qc)
 	int ic = 0;
 	int done = 0;
 
-	ivec = (char **) xmalloc((ic+1)*sizeof(char *));
+	ivec = xreallocarray(NULL, ic + 1, sizeof *ivec);
 
 	while (!done) {
 		char *v;
@@ -144,7 +149,7 @@ strsplit(char *s, int ch, int qc)
 		 * save string in new ivec slot
 		 */
 		ivec[ic++] = v;
-		ivec = (char **) xrealloc((void *)ivec, (ic+1)*sizeof(char *));
+		ivec = xreallocarray(ivec, ic + 1, sizeof *ivec);
 #ifdef DEBUG
 		Debug(D_STR)
 			plog(XLOG_DEBUG, "strsplit saved \"%s\"", v);
diff --git a/usr.sbin/amd/amd/xutil.c b/usr.sbin/amd/amd/xutil.c
index 4403c00ff24..8c03e877c10 100644
--- a/usr.sbin/amd/amd/xutil.c
+++ b/usr.sbin/amd/amd/xutil.c
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)xutil.c	8.1 (Berkeley) 6/6/93
- *	$Id: xutil.c,v 1.13 2014/10/20 00:20:04 guenther Exp $
+ *	$Id: xutil.c,v 1.14 2014/10/26 01:16:48 guenther Exp $
  */
 
 #include "config.h"
@@ -68,23 +68,25 @@ struct opt_tab xlog_opt[] = {
 	{ 0, 0 }
 };
 
+__dead void
+xmallocfailure(void)
+{
+	plog(XLOG_FATAL, "Out of memory");
+	going_down(1);
+	abort();
+}
+
 void *
-xmalloc(int len)
+xmalloc(size_t len)
 {
 	void *p;
 	int retries = 600;
 
-	/*
-	 * Avoid malloc's which return NULL for malloc(0)
-	 */
-	if (len == 0)
-		len = 1;
-
 	do {
-		p = (void *)malloc((unsigned) len);
+		p = malloc(len);
 		if (p) {
 #if defined(DEBUG) && defined(DEBUG_MEM)
-			Debug(D_MEM) plog(XLOG_DEBUG, "Allocated size %d; block %#x", len, p);
+			Debug(D_MEM) plog(XLOG_DEBUG, "Allocated size %zu; block %#x", len, p);
 #endif /* defined(DEBUG) && defined(DEBUG_MEM) */
 			return p;
 		}
@@ -94,35 +96,21 @@ xmalloc(int len)
 		}
 	} while (--retries);
 
-	plog(XLOG_FATAL, "Out of memory");
-	going_down(1);
-
-	abort();
-
-	return 0;
+	xmallocfailure();
 }
 
 void *
-xrealloc(void *ptr, int len)
+xreallocarray(void *ptr, size_t nmemb, size_t size)
 {
 #if defined(DEBUG) && defined(DEBUG_MEM)
-	Debug(D_MEM) plog(XLOG_DEBUG, "Reallocated size %d; block %#x", len, ptr);
+	Debug(D_MEM) plog(XLOG_DEBUG, "Reallocated nmemb %zu of size %zu; block %#x", nmemb, size, ptr);
 #endif /* defined(DEBUG) && defined(DEBUG_MEM) */
 
-	if (len == 0)
-		len = 1;
+	ptr = reallocarray(ptr, nmemb, size);
 
-	if (ptr)
-		ptr = (void *)realloc(ptr, (unsigned) len);
-	else
-		ptr = (void *)xmalloc((unsigned) len);
-
-	if (!ptr) {
-		plog(XLOG_FATAL, "Out of memory in realloc");
-		going_down(1);
-		abort();
-	}
-	return ptr;
+	if (ptr == NULL)
+		xmallocfailure();
+	return (ptr);
 }
 
 #if defined(DEBUG) && defined(DEBUG_MEM)
diff --git a/usr.sbin/amd/include/config.h b/usr.sbin/amd/include/config.h
index 86b9190ddd7..2badb742c95 100644
--- a/usr.sbin/amd/include/config.h
+++ b/usr.sbin/amd/include/config.h
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)config.h	8.1 (Berkeley) 6/6/93
- *	$Id: config.h,v 1.9 2014/10/20 06:55:59 guenther Exp $
+ *	$Id: config.h,v 1.10 2014/10/26 01:16:49 guenther Exp $
  */
 
 /*
@@ -95,7 +95,8 @@ extern void going_down(int);
 #ifdef DEBUG
 #define dplog(fmt, args...) plog(XLOG_DEBUG, fmt, ## args)
 #endif /* DEBUG */
-extern void plog(int, char *, ...);
+extern void plog(int, char *, ...) __attribute__((__format__ (syslog, 2, 3)));
 extern void show_opts(int ch, struct opt_tab *);
-extern void *xmalloc(int);
-extern void *xrealloc(void *, int);
+__dead void xmallocfailure(void);
+extern void *xmalloc(size_t);
+extern void *xreallocarray(void *, size_t, size_t);