- djm@cvs.openbsd.org 2006/03/25 01:13:23

     [buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
     [sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
     [uidswap.c]
     change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
     to xrealloc(p, new_nmemb, new_itemsize).

     realloc is particularly prone to integer overflows because it is
     almost always allocating "n * size" bytes, so this is a far safer
     API; ok deraadt@

1 files changed, 1 insertions, 1 deletions

diff --git a/sftp-server.c b/sftp-server.c
index a6add52aa..52b7323c2 100644
--- a/sftp-server.c
+++ b/sftp-server.c
@@ -716,7 +716,7 @@ process_readdir(void)
                 while ((dp = readdir(dirp)) != NULL) {
                         if (count >= nstats) {
                                 nstats *= 2;
-                                stats = xrealloc(stats, nstats * sizeof(Stat));
+                                stats = xrealloc(stats, nstats, sizeof(Stat));
                         }
 /* XXX OVERFLOW ? */
                         snprintf(pathname, sizeof pathname, "%s%s%s", path,