use calloc() to avoid malloc(n * m) overflows; checked by djm canacar jsg

3 files changed, 6 insertions, 6 deletions

diff --git a/lib/libc/net/getprotoent.c b/lib/libc/net/getprotoent.c
index 7c6ab681664..f0705e0765e 100644
--- a/lib/libc/net/getprotoent.c
+++ b/lib/libc/net/getprotoent.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: getprotoent.c,v 1.9 2006/01/17 15:41:52 millert Exp $ */
+/*	$OpenBSD: getprotoent.c,v 1.10 2007/09/02 15:19:17 deraadt Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -102,7 +102,7 @@ again:
 	pe->p_proto = l;
 	if (pd->aliases == NULL) {
 		pd->maxaliases = 5;
-		pd->aliases = malloc(pd->maxaliases * sizeof(char *));
+		pd->aliases = calloc(pd->maxaliases, sizeof(char *));
 		if (pd->aliases == NULL) {
 			serrno = errno;
 			endprotoent_r(pd);
diff --git a/lib/libc/net/getservent.c b/lib/libc/net/getservent.c
index ab916b8e80f..c81a4cf3e29 100644
--- a/lib/libc/net/getservent.c
+++ b/lib/libc/net/getservent.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: getservent.c,v 1.11 2006/01/17 15:41:52 millert Exp $ */
+/*	$OpenBSD: getservent.c,v 1.12 2007/09/02 15:19:17 deraadt Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -104,7 +104,7 @@ again:
 	se->s_proto = cp;
 	if (sd->aliases == NULL) {
 		sd->maxaliases = 10;
-		sd->aliases = malloc(sd->maxaliases * sizeof(char *));
+		sd->aliases = calloc(sd->maxaliases, sizeof(char *));
 		if (sd->aliases == NULL) {
 			serrno = errno;
 			endservent_r(sd);
diff --git a/lib/libc/net/rcmdsh.c b/lib/libc/net/rcmdsh.c
index 34a228d1e95..a472162711b 100644
--- a/lib/libc/net/rcmdsh.c
+++ b/lib/libc/net/rcmdsh.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rcmdsh.c,v 1.11 2005/08/06 20:30:03 espie Exp $	*/ 
+/*	$OpenBSD: rcmdsh.c,v 1.12 2007/09/02 15:19:17 deraadt Exp $	*/ 
 
 /*
  * Copyright (c) 2001, MagniComp
@@ -151,7 +151,7 @@ rcmdsh(char **ahost, int rport, const char *locuser, const char *remuser,
 			for (n = 7; (p = strchr(++p, ' ')) != NULL; n++)
 				continue;
 			rshprog = strdup(rshprog);
-			ap = argv = malloc(sizeof(char *) * n);
+			ap = argv = calloc(sizeof(char *), n);
 			if (rshprog == NULL || argv == NULL) {
 				perror("rcmdsh");
 				_exit(255);