diff options
author | jhb <jhb@FreeBSD.org> | 2013-01-28 15:48:31 +0000 |
---|---|---|
committer | jhb <jhb@FreeBSD.org> | 2013-01-28 15:48:31 +0000 |
commit | 7756bef786978bd5d07c05b55bc8428454d6837d (patch) | |
tree | 463132b6a908ec2e5a240a7065cfd9d8ee4e62e3 | |
parent | 74295506311b9507b710b2729ba15e2fa5a611c8 (diff) | |
download | FreeBSD-src-7756bef786978bd5d07c05b55bc8428454d6837d.zip FreeBSD-src-7756bef786978bd5d07c05b55bc8428454d6837d.tar.gz |
- Compute the correct size to reallocate when doubling the size of the
array of loaded objects to avoid a buffer overrun.
- Use reallocf() to avoid leaking memory if the realloc() fails.
PR: kern/175648
Submitted by: yuri@rawbw.com (1)
MFC after: 1 week
-rw-r--r-- | lib/libproc/proc_rtld.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/libproc/proc_rtld.c b/lib/libproc/proc_rtld.c index 2a9ed39..5259049 100644 --- a/lib/libproc/proc_rtld.c +++ b/lib/libproc/proc_rtld.c @@ -44,7 +44,8 @@ map_iter(const rd_loadobj_t *lop, void *arg) if (phdl->nobjs >= phdl->rdobjsz) { phdl->rdobjsz *= 2; - phdl->rdobjs = realloc(phdl->rdobjs, phdl->rdobjsz); + phdl->rdobjs = reallocf(phdl->rdobjs, sizeof(*phdl->rdobjs) * + phdl->rdobjsz); if (phdl->rdobjs == NULL) return (-1); } |