diff options
| author | fjoe <fjoe@FreeBSD.org> | 2011-11-24 18:45:23 +0000 |
|---|---|---|
| committer | fjoe <fjoe@FreeBSD.org> | 2011-11-24 18:45:23 +0000 |
| commit | 8594dfe0c067d7d5eae2ce15f72c85cfa451d92d (patch) | |
| tree | f64e4e6588f062ab135da5b0eaa34c3228664cb3 | |
| parent | 73353fa9468456dfe7a8fa351228fd25538f99e3 (diff) | |
| download | FreeBSD-src-8594dfe0c067d7d5eae2ce15f72c85cfa451d92d.zip FreeBSD-src-8594dfe0c067d7d5eae2ce15f72c85cfa451d92d.tar.gz | |
calloc +1 DIALOG_LISTITEM to prevent possible wild pointer access
in dlg_default_listitem().
| -rw-r--r-- | usr.sbin/tzsetup/tzsetup.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/usr.sbin/tzsetup/tzsetup.c b/usr.sbin/tzsetup/tzsetup.c index 78f917a..656d2ca 100644 --- a/usr.sbin/tzsetup/tzsetup.c +++ b/usr.sbin/tzsetup/tzsetup.c @@ -76,14 +76,14 @@ static int xdialog_menu(const char *title, const char *cprompt, int height, int width, int menu_height, int item_no, dialogMenuItem *ditems) { - int i, result, choice; + int i, result, choice = 0; DIALOG_LISTITEM *listitems; DIALOG_VARS save_vars; dlg_save_vars(&save_vars); /* initialize list items */ - listitems = dlg_calloc(DIALOG_LISTITEM, item_no); + listitems = dlg_calloc(DIALOG_LISTITEM, item_no + 1); assert_ptr(listitems, "xdialog_menu"); for (i = 0; i < item_no; i++) { listitems[i].name = ditems[i].prompt; @@ -111,7 +111,7 @@ xdialog_menu(const char *title, const char *cprompt, int height, int width, width = COLS; again: - dialog_vars.default_item = ditems[choice].prompt; + dialog_vars.default_item = listitems[choice].name; result = dlg_menu(title, cprompt, height, width, menu_height, item_no, listitems, &choice, NULL); switch (result) { |
