Author: pfg
Date: Tue Mar 7 19:30:22 2017
New Revision: 314877
URL: https://svnweb.freebsd.org/changeset/base/314877
Log:
lpr(1): small bounds check with reallocarray(3).
While here plug a memory leak upon error and postpose a multiplication
until after reallocation has succeded.
Hinted partially by: OpenBSD
Reviewed by: gad
MFC after: 2 weeks
Modified:
head/usr.sbin/lpr/common_source/common.c
Modified: head/usr.sbin/lpr/common_source/common.c
==============================================================================
--- head/usr.sbin/lpr/common_source/common.c Tue Mar 7 19:00:50 2017
(r314876)
+++ head/usr.sbin/lpr/common_source/common.c Tue Mar 7 19:30:22 2017
(r314877)
@@ -167,11 +167,13 @@ getq(const struct printer *pp, struct jo
* realloc the maximum size.
*/
if (++nitems > arraysz) {
- arraysz *= 2;
- queue = (struct jobqueue **)realloc((char *)queue,
- arraysz * sizeof(struct jobqueue *));
- if (queue == NULL)
+ queue = (struct jobqueue **)reallocarray((char *)queue,
+ arraysz, 2 * sizeof(struct jobqueue *));
+ if (queue == NULL) {
+ free(q);
goto errdone;
+ }
+ arraysz *= 2;
}
queue[nitems-1] = q;
}
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "[email protected]"
