diff options
| author | djm <djm> | 2006-03-26 03:22:47 +0000 |
|---|---|---|
| committer | djm <djm> | 2006-03-26 03:22:47 +0000 |
| commit | 5e5513faf51451ded4af614cb6c6390282690c9b (patch) | |
| tree | 1ae514355b3e707ae4c419a565852b3faa3ee3ff /ssh-rand-helper.c | |
| parent | 02eed99ef7f2174344b2a099b5ff4d93a3d5f0f5 (diff) | |
| download | openssh-5e5513faf51451ded4af614cb6c6390282690c9b.tar.gz | |
- djm@cvs.openbsd.org 2006/03/25 01:13:23
[buffer.c channels.c deattack.c misc.c scp.c session.c sftp-client.c]
[sftp-server.c ssh-agent.c ssh-rsa.c xmalloc.c xmalloc.h auth-pam.c]
[uidswap.c]
change OpenSSH's xrealloc() function from being xrealloc(p, new_size)
to xrealloc(p, new_nmemb, new_itemsize).
realloc is particularly prone to integer overflows because it is
almost always allocating "n * size" bytes, so this is a far safer
API; ok deraadt@
Diffstat (limited to 'ssh-rand-helper.c')
| -rw-r--r-- | ssh-rand-helper.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ssh-rand-helper.c b/ssh-rand-helper.c index bdf73ec4..662f7008 100644 --- a/ssh-rand-helper.c +++ b/ssh-rand-helper.c @@ -768,7 +768,7 @@ prng_read_commands(char *cmdfilename) */ if (cur_cmd == num_cmds) { num_cmds *= 2; - entcmd = xrealloc(entcmd, num_cmds * + entcmd = xrealloc(entcmd, num_cmds, sizeof(entropy_cmd_t)); } } @@ -777,7 +777,7 @@ prng_read_commands(char *cmdfilename) memset(&entcmd[cur_cmd], '\0', sizeof(entropy_cmd_t)); /* trim to size */ - entropy_cmds = xrealloc(entcmd, (cur_cmd + 1) * + entropy_cmds = xrealloc(entcmd, (cur_cmd + 1), sizeof(entropy_cmd_t)); debug("Loaded %d entropy commands from %.100s", cur_cmd, |