diff options
| author | pfg <pfg@FreeBSD.org> | 2017-03-21 03:42:28 +0000 |
|---|---|---|
| committer | pfg <pfg@FreeBSD.org> | 2017-03-21 03:42:28 +0000 |
| commit | 183e2f0e8dba164bc64ad9ad043d4e803a72add4 (patch) | |
| tree | 82e566225ab6b6d63f7fffeb861b4152c0079701 /usr.sbin | |
| parent | 5e396452e4053c6aecb09fcbd6219d90c350c095 (diff) | |
| download | FreeBSD-src-183e2f0e8dba164bc64ad9ad043d4e803a72add4.zip FreeBSD-src-183e2f0e8dba164bc64ad9ad043d4e803a72add4.tar.gz | |
MFC r314877:
lpr(1): small bounds check with reallocarray(3).
While here plug a memory leak upon error and postpose the multiplication
until after reallocation has succeded.
Hinted partially by: OpenBSD
Reviewed by: gad
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/lpr/common_source/common.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/usr.sbin/lpr/common_source/common.c b/usr.sbin/lpr/common_source/common.c index 7311940..729e0c9 100644 --- a/usr.sbin/lpr/common_source/common.c +++ b/usr.sbin/lpr/common_source/common.c @@ -167,11 +167,13 @@ getq(const struct printer *pp, struct jobqueue *(*namelist[])) * realloc the maximum size. */ if (++nitems > arraysz) { - arraysz *= 2; - queue = (struct jobqueue **)realloc((char *)queue, - arraysz * sizeof(struct jobqueue *)); - if (queue == NULL) + queue = (struct jobqueue **)reallocarray((char *)queue, + arraysz, 2 * sizeof(struct jobqueue *)); + if (queue == NULL) { + free(q); goto errdone; + } + arraysz *= 2; } queue[nitems-1] = q; } |
