svn commit: r315659 - stable/11/usr.sbin/lpr/common_source
Pedro F. Giffuni
pfg at FreeBSD.org
Tue Mar 21 03:42:30 UTC 2017
Author: pfg
Date: Tue Mar 21 03:42:28 2017
New Revision: 315659
URL: https://svnweb.freebsd.org/changeset/base/315659
Log:
MFC r314877:
lpr(1): small bounds check with reallocarray(3).
While here plug a memory leak upon error and postpose the multiplication
until after reallocation has succeded.
Hinted partially by: OpenBSD
Reviewed by: gad
Modified:
stable/11/usr.sbin/lpr/common_source/common.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/usr.sbin/lpr/common_source/common.c
==============================================================================
--- stable/11/usr.sbin/lpr/common_source/common.c Tue Mar 21 01:24:56 2017 (r315658)
+++ stable/11/usr.sbin/lpr/common_source/common.c Tue Mar 21 03:42:28 2017 (r315659)
@@ -167,11 +167,13 @@ getq(const struct printer *pp, struct jo
* realloc the maximum size.
*/
if (++nitems > arraysz) {
- arraysz *= 2;
- queue = (struct jobqueue **)realloc((char *)queue,
- arraysz * sizeof(struct jobqueue *));
- if (queue == NULL)
+ queue = (struct jobqueue **)reallocarray((char *)queue,
+ arraysz, 2 * sizeof(struct jobqueue *));
+ if (queue == NULL) {
+ free(q);
goto errdone;
+ }
+ arraysz *= 2;
}
queue[nitems-1] = q;
}
More information about the svn-src-stable
mailing list