- djm@cvs.openbsd.org 2006/03/25 01:13:23

     [buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
     [sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
     [uidswap.c]
     change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
     to xrealloc(p, new_nmemb, new_itemsize).

     realloc is particularly prone to integer overflows because it is
     almost always allocating "n * size" bytes, so this is a far safer
     API; ok deraadt@

1 files changed, 1 insertions, 1 deletions

diff --git a/scp.c b/scp.c
index bf9db97cf..3068b8d32 100644
--- a/scp.c
+++ b/scp.c
@@ -1190,7 +1190,7 @@ allocbuf(BUF *bp, int fd, int blksize)
         if (bp->buf == NULL)
                 bp->buf = xmalloc(size);
         else
-                bp->buf = xrealloc(bp->buf, size);
+                bp->buf = xrealloc(bp->buf, 1, size);
         memset(bp->buf, 0, size);
         bp->cnt = size;
         return (bp);