diff options
author | Damien Miller <djm@mindrot.org> | 2006-03-26 14:22:47 +1100 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2006-03-26 14:22:47 +1100 |
commit | 36812092ecb11a25ca9d6d87fdeaf53e371c5043 (patch) | |
tree | 257ccc18998146f7f6e6c25cbb0ff9bd6de946a5 /xmalloc.c | |
parent | 07d86bec5eeaf19fe33dca99c8ebcbe9a77c3938 (diff) |
- djm@cvs.openbsd.org 2006/03/25 01:13:23
[buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
[sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
[uidswap.c]
change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
to xrealloc(p, new_nmemb, new_itemsize).
realloc is particularly prone to integer overflows because it is
almost always allocating "n * size" bytes, so this is a far safer
API; ok deraadt@
Diffstat (limited to 'xmalloc.c')
-rw-r--r-- | xmalloc.c | 10 |
1 files changed, 7 insertions, 3 deletions
@@ -35,7 +35,7 @@ xcalloc(size_t nmemb, size_t size) | |||
35 | { | 35 | { |
36 | void *ptr; | 36 | void *ptr; |
37 | 37 | ||
38 | if (nmemb && size && SIZE_T_MAX / nmemb < size) | 38 | if (nmemb && size && SIZE_T_MAX / nmemb < size) |
39 | fatal("xcalloc: nmemb * size > SIZE_T_MAX"); | 39 | fatal("xcalloc: nmemb * size > SIZE_T_MAX"); |
40 | if (size == 0 || nmemb == 0) | 40 | if (size == 0 || nmemb == 0) |
41 | fatal("xcalloc: zero size"); | 41 | fatal("xcalloc: zero size"); |
@@ -47,10 +47,13 @@ xcalloc(size_t nmemb, size_t size) | |||
47 | } | 47 | } |
48 | 48 | ||
49 | void * | 49 | void * |
50 | xrealloc(void *ptr, size_t new_size) | 50 | xrealloc(void *ptr, size_t nmemb, size_t size) |
51 | { | 51 | { |
52 | void *new_ptr; | 52 | void *new_ptr; |
53 | size_t new_size = nmemb * size; | ||
53 | 54 | ||
55 | if (nmemb && size && SIZE_T_MAX / nmemb < size) | ||
56 | fatal("xrealloc: nmemb * size > SIZE_T_MAX"); | ||
54 | if (new_size == 0) | 57 | if (new_size == 0) |
55 | fatal("xrealloc: zero size"); | 58 | fatal("xrealloc: zero size"); |
56 | if (ptr == NULL) | 59 | if (ptr == NULL) |
@@ -58,7 +61,8 @@ xrealloc(void *ptr, size_t new_size) | |||
58 | else | 61 | else |
59 | new_ptr = realloc(ptr, new_size); | 62 | new_ptr = realloc(ptr, new_size); |
60 | if (new_ptr == NULL) | 63 | if (new_ptr == NULL) |
61 | fatal("xrealloc: out of memory (new_size %lu bytes)", (u_long) new_size); | 64 | fatal("xrealloc: out of memory (new_size %lu bytes)", |
65 | (u_long) new_size); | ||
62 | return new_ptr; | 66 | return new_ptr; |
63 | } | 67 | } |
64 | 68 | ||