diff options
author | Damien Miller <djm@mindrot.org> | 2006-03-26 14:22:47 +1100 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2006-03-26 14:22:47 +1100 |
commit | 36812092ecb11a25ca9d6d87fdeaf53e371c5043 (patch) | |
tree | 257ccc18998146f7f6e6c25cbb0ff9bd6de946a5 /uidswap.c | |
parent | 07d86bec5eeaf19fe33dca99c8ebcbe9a77c3938 (diff) |
- djm@cvs.openbsd.org 2006/03/25 01:13:23
[buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
[sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
[uidswap.c]
change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
to xrealloc(p, new_nmemb, new_itemsize).
realloc is particularly prone to integer overflows because it is
almost always allocating "n * size" bytes, so this is a far safer
API; ok deraadt@
Diffstat (limited to 'uidswap.c')
-rw-r--r-- | uidswap.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -76,7 +76,7 @@ temporarily_use_uid(struct passwd *pw) | |||
76 | fatal("getgroups: %.100s", strerror(errno)); | 76 | fatal("getgroups: %.100s", strerror(errno)); |
77 | if (saved_egroupslen > 0) { | 77 | if (saved_egroupslen > 0) { |
78 | saved_egroups = xrealloc(saved_egroups, | 78 | saved_egroups = xrealloc(saved_egroups, |
79 | saved_egroupslen * sizeof(gid_t)); | 79 | saved_egroupslen, sizeof(gid_t)); |
80 | if (getgroups(saved_egroupslen, saved_egroups) < 0) | 80 | if (getgroups(saved_egroupslen, saved_egroups) < 0) |
81 | fatal("getgroups: %.100s", strerror(errno)); | 81 | fatal("getgroups: %.100s", strerror(errno)); |
82 | } else { /* saved_egroupslen == 0 */ | 82 | } else { /* saved_egroupslen == 0 */ |
@@ -95,7 +95,7 @@ temporarily_use_uid(struct passwd *pw) | |||
95 | fatal("getgroups: %.100s", strerror(errno)); | 95 | fatal("getgroups: %.100s", strerror(errno)); |
96 | if (user_groupslen > 0) { | 96 | if (user_groupslen > 0) { |
97 | user_groups = xrealloc(user_groups, | 97 | user_groups = xrealloc(user_groups, |
98 | user_groupslen * sizeof(gid_t)); | 98 | user_groupslen, sizeof(gid_t)); |
99 | if (getgroups(user_groupslen, user_groups) < 0) | 99 | if (getgroups(user_groupslen, user_groups) < 0) |
100 | fatal("getgroups: %.100s", strerror(errno)); | 100 | fatal("getgroups: %.100s", strerror(errno)); |
101 | } else { /* user_groupslen == 0 */ | 101 | } else { /* user_groupslen == 0 */ |