- djm@cvs.openbsd.org 2010/06/17 07:07:30

     [mux.c]
     Correct sizing of object to be allocated by calloc(), replacing
     sizeof(state) with sizeof(*state). This worked by accident since
     the struct contained a single int at present, but could have broken
     in the future. patch from hyc AT symas.com

2 files changed, 8 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 1d990febb..b052a202c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,12 @@
      [ssh-pkcs11.c]
      check length of value returned  C_GetAttributValue for != 0
      from mdrtbugzilla@codefive.co.uk; bugzilla #1773; ok dtucker@
+   - djm@cvs.openbsd.org 2010/06/17 07:07:30
+     [mux.c]
+     Correct sizing of object to be allocated by calloc(), replacing
+     sizeof(state) with sizeof(*state). This worked by accident since
+     the struct contained a single int at present, but could have broken
+     in the future. patch from hyc AT symas.com
 
 20100622
  - (djm) [loginrec.c] crank LINFO_NAMESIZE (username length) to 512
diff --git a/mux.c b/mux.c
index 3f5babccc..70c8d2ade 100644
--- a/mux.c
+++ b/mux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mux.c,v 1.18 2010/05/16 12:55:51 markus Exp $ */
+/* $OpenBSD: mux.c,v 1.19 2010/06/17 07:07:30 djm Exp $ */
 /*
  * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
  *
@@ -931,7 +931,7 @@ mux_master_read_cb(Channel *c)
 
         /* Setup ctx and  */
         if (c->mux_ctx == NULL) {
-                state = xcalloc(1, sizeof(state));
+                state = xcalloc(1, sizeof(*state));
                 c->mux_ctx = state;
                 channel_register_cleanup(c->self,
                     mux_master_control_cleanup_cb, 0);