use calloc() to avoid malloc(n * m) overflows; checked by djm canacar jsg

16 files changed, 38 insertions, 38 deletions

diff --git a/lib/libc/gen/getnetgrent.c b/lib/libc/gen/getnetgrent.c
index 51493ed422c..937ce158d1e 100644
--- a/lib/libc/gen/getnetgrent.c
+++ b/lib/libc/gen/getnetgrent.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: getnetgrent.c,v 1.18 2007/03/05 20:29:14 millert Exp $	*/
+/*	$OpenBSD: getnetgrent.c,v 1.19 2007/09/02 15:19:16 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1994 Christos Zoulas
@@ -88,7 +88,7 @@ _ng_sl_init(void)
 
 	sl->sl_cur = 0;
 	sl->sl_max = 20;
-	sl->sl_str = malloc(sl->sl_max * sizeof(char *));
+	sl->sl_str = calloc(sl->sl_max, sizeof(char *));
 	if (sl->sl_str == NULL)
 		return NULL;
 	return sl;
diff --git a/lib/libc/gen/login_cap.c b/lib/libc/gen/login_cap.c
index de8b048c349..fb6a7e0df8b 100644
--- a/lib/libc/gen/login_cap.c
+++ b/lib/libc/gen/login_cap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: login_cap.c,v 1.26 2006/04/09 04:40:35 deraadt Exp $	*/
+/*	$OpenBSD: login_cap.c,v 1.27 2007/09/02 15:19:16 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2000-2004 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -180,7 +180,7 @@ login_getstyle(login_cap_t *lc, char *style, char *atype)
 		while (*ta)
 			if (*ta++ == ',')
 				++i;
-		f2 = authtypes = malloc(sizeof(char *) * i);
+		f2 = authtypes = calloc(sizeof(char *), i);
 		if (!authtypes) {
 			syslog(LOG_ERR, "malloc: %m");
 			free(f1);
diff --git a/lib/libc/gen/scandir.c b/lib/libc/gen/scandir.c
index 089ad19e0da..2ad8c3e612e 100644
--- a/lib/libc/gen/scandir.c
+++ b/lib/libc/gen/scandir.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: scandir.c,v 1.11 2007/06/26 05:00:50 ray Exp $ */
+/*	$OpenBSD: scandir.c,v 1.12 2007/09/02 15:19:16 deraadt Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -78,7 +78,7 @@ scandir(const char *dirname, struct dirent ***namelist,
 		errno = ENOMEM;
 		goto fail;
 	}
-	names = (struct dirent **)malloc(arraysz * sizeof(struct dirent *));
+	names = (struct dirent **)calloc(arraysz, sizeof(struct dirent *));
 	if (names == NULL)
 		goto fail;
 
diff --git a/lib/libc/gen/setmode.c b/lib/libc/gen/setmode.c
index 843b46183c9..9cc2cbc59ba 100644
--- a/lib/libc/gen/setmode.c
+++ b/lib/libc/gen/setmode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: setmode.c,v 1.19 2006/03/12 18:36:46 otto Exp $	*/
+/*	$OpenBSD: setmode.c,v 1.20 2007/09/02 15:19:16 deraadt Exp $	*/
 /*	$NetBSD: setmode.c,v 1.15 1997/02/07 22:21:06 christos Exp $	*/
 
 /*
@@ -187,7 +187,7 @@ setmode(const char *p)
 
 	setlen = SET_LEN + 2;
 	
-	if ((set = malloc((u_int)(sizeof(BITCMD) * setlen))) == NULL)
+	if ((set = calloc((u_int)sizeof(BITCMD), setlen)) == NULL)
 		return (NULL);
 	saveset = set;
 	endset = set + (setlen - 2);
diff --git a/lib/libc/gen/strtofflags.c b/lib/libc/gen/strtofflags.c
index 9eba0f4517d..a54fd2ce843 100644
--- a/lib/libc/gen/strtofflags.c
+++ b/lib/libc/gen/strtofflags.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: strtofflags.c,v 1.5 2005/08/08 08:05:34 espie Exp $	*/
+/*	$OpenBSD: strtofflags.c,v 1.6 2007/09/02 15:19:16 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 1993
@@ -82,7 +82,7 @@ fflagstostr(u_int32_t flags)
 	u_int32_t setflags;
 	int i;
 
-	if ((string = (char *)malloc(nmappings * (longestflaglen + 1))) == NULL)
+	if ((string = (char *)calloc(nmappings, longestflaglen + 1)) == NULL)
 		return (NULL);
 
 	setflags = flags;
diff --git a/lib/libc/net/getprotoent.c b/lib/libc/net/getprotoent.c
index 7c6ab681664..f0705e0765e 100644
--- a/lib/libc/net/getprotoent.c
+++ b/lib/libc/net/getprotoent.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: getprotoent.c,v 1.9 2006/01/17 15:41:52 millert Exp $ */
+/*	$OpenBSD: getprotoent.c,v 1.10 2007/09/02 15:19:17 deraadt Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -102,7 +102,7 @@ again:
 	pe->p_proto = l;
 	if (pd->aliases == NULL) {
 		pd->maxaliases = 5;
-		pd->aliases = malloc(pd->maxaliases * sizeof(char *));
+		pd->aliases = calloc(pd->maxaliases, sizeof(char *));
 		if (pd->aliases == NULL) {
 			serrno = errno;
 			endprotoent_r(pd);
diff --git a/lib/libc/net/getservent.c b/lib/libc/net/getservent.c
index ab916b8e80f..c81a4cf3e29 100644
--- a/lib/libc/net/getservent.c
+++ b/lib/libc/net/getservent.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: getservent.c,v 1.11 2006/01/17 15:41:52 millert Exp $ */
+/*	$OpenBSD: getservent.c,v 1.12 2007/09/02 15:19:17 deraadt Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -104,7 +104,7 @@ again:
 	se->s_proto = cp;
 	if (sd->aliases == NULL) {
 		sd->maxaliases = 10;
-		sd->aliases = malloc(sd->maxaliases * sizeof(char *));
+		sd->aliases = calloc(sd->maxaliases, sizeof(char *));
 		if (sd->aliases == NULL) {
 			serrno = errno;
 			endservent_r(sd);
diff --git a/lib/libc/net/rcmdsh.c b/lib/libc/net/rcmdsh.c
index 34a228d1e95..a472162711b 100644
--- a/lib/libc/net/rcmdsh.c
+++ b/lib/libc/net/rcmdsh.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rcmdsh.c,v 1.11 2005/08/06 20:30:03 espie Exp $	*/ 
+/*	$OpenBSD: rcmdsh.c,v 1.12 2007/09/02 15:19:17 deraadt Exp $	*/ 
 
 /*
  * Copyright (c) 2001, MagniComp
@@ -151,7 +151,7 @@ rcmdsh(char **ahost, int rport, const char *locuser, const char *remuser,
 			for (n = 7; (p = strchr(++p, ' ')) != NULL; n++)
 				continue;
 			rshprog = strdup(rshprog);
-			ap = argv = malloc(sizeof(char *) * n);
+			ap = argv = calloc(sizeof(char *), n);
 			if (rshprog == NULL || argv == NULL) {
 				perror("rcmdsh");
 				_exit(255);
diff --git a/lib/libc/regex/regcomp.c b/lib/libc/regex/regcomp.c
index 402c64056f3..83b1dfbd67a 100644
--- a/lib/libc/regex/regcomp.c
+++ b/lib/libc/regex/regcomp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: regcomp.c,v 1.16 2006/03/31 05:36:36 deraadt Exp $ */
+/*	$OpenBSD: regcomp.c,v 1.17 2007/09/02 15:19:17 deraadt Exp $ */
 /*-
  * Copyright (c) 1992, 1993, 1994 Henry Spencer.
  * Copyright (c) 1992, 1993, 1994
@@ -176,7 +176,7 @@ regcomp(regex_t *preg, const char *pattern, int cflags)
 	if (g == NULL)
 		return(REG_ESPACE);
 	p->ssize = len/(size_t)2*(size_t)3 + (size_t)1;	/* ugh */
-	p->strip = (sop *)malloc(p->ssize * sizeof(sop));
+	p->strip = (sop *)calloc(p->ssize, sizeof(sop));
 	p->slen = 0;
 	if (p->strip == NULL) {
 		free((char *)g);
@@ -1031,7 +1031,7 @@ allocset(struct parse *p)
 		assert(nc % CHAR_BIT == 0);
 		nbytes = nc / CHAR_BIT * css;
 		if (p->g->sets == NULL)
-			p->g->sets = (cset *)malloc(nc * sizeof(cset));
+			p->g->sets = (cset *)calloc(nc, sizeof(cset));
 		else {
 			cset *ptr;
 			ptr = (cset *)realloc((char *)p->g->sets,
diff --git a/lib/libc/rpc/pmap_rmt.c b/lib/libc/rpc/pmap_rmt.c
index 76adaddd2a3..2265041a797 100644
--- a/lib/libc/rpc/pmap_rmt.c
+++ b/lib/libc/rpc/pmap_rmt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pmap_rmt.c,v 1.27 2006/09/22 18:42:04 otto Exp $ */
+/*	$OpenBSD: pmap_rmt.c,v 1.28 2007/09/02 15:19:17 deraadt Exp $ */
 /*
  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
  * unrestricted use provided that this legend is included on all tape
@@ -172,7 +172,7 @@ newgetbroadcastnets(struct in_addr **addrsp)
 		}
 	}
 
-	addrs = (struct in_addr *)malloc(n * sizeof(*addrs));
+	addrs = (struct in_addr *)calloc(n, sizeof(*addrs));
 	if (addrs == NULL) {
 		freeifaddrs(ifap);
 		return 0;
diff --git a/lib/libc/stdlib/hcreate.c b/lib/libc/stdlib/hcreate.c
index f8df1bcd7c9..094f32c173e 100644
--- a/lib/libc/stdlib/hcreate.c
+++ b/lib/libc/stdlib/hcreate.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hcreate.c,v 1.3 2005/10/10 17:37:44 espie Exp $	*/
+/*	$OpenBSD: hcreate.c,v 1.4 2007/09/02 15:19:17 deraadt Exp $	*/
 /*	$NetBSD: hcreate.c,v 1.5 2004/04/23 02:48:12 simonb Exp $	*/
 
 /*
@@ -117,7 +117,7 @@ hcreate(size_t nel)
 	
 	/* Allocate the table. */
 	htablesize = nel;
-	htable = malloc(htablesize * sizeof htable[0]);
+	htable = calloc(htablesize, sizeof htable[0]);
 	if (htable == NULL) {
 		errno = ENOMEM;
 		return 0;
diff --git a/lib/libc/stdlib/radixsort.c b/lib/libc/stdlib/radixsort.c
index 0b2ff27044f..49d03b52d5d 100644
--- a/lib/libc/stdlib/radixsort.c
+++ b/lib/libc/stdlib/radixsort.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: radixsort.c,v 1.8 2005/08/08 08:05:37 espie Exp $ */
+/*	$OpenBSD: radixsort.c,v 1.9 2007/09/02 15:19:17 deraadt Exp $ */
 /*-
  * Copyright (c) 1990, 1993
  *	The Regents of the University of California.  All rights reserved.
@@ -104,7 +104,7 @@ sradixsort(const u_char **a, int n, const u_char *tab, u_int endch)
 	if (n < THRESHOLD)
 		simplesort(a, n, 0, tr, endch);
 	else {
-		if ((ta = malloc(n * sizeof(a))) == NULL)
+		if ((ta = calloc(n, sizeof(a))) == NULL)
 			return (-1);
 		r_sort_b(a, ta, n, 0, tr, endch);
 		free(ta);
diff --git a/lib/libc/string/bm.c b/lib/libc/string/bm.c
index 829c24082e5..2c4c6ca7207 100644
--- a/lib/libc/string/bm.c
+++ b/lib/libc/string/bm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bm.c,v 1.6 2005/08/08 08:05:37 espie Exp $ */
+/*	$OpenBSD: bm.c,v 1.7 2007/09/02 15:19:18 deraadt Exp $ */
 /*-
  * Copyright (c) 1994
  *	The Regents of the University of California.  All rights reserved.
@@ -104,7 +104,7 @@ bm_comp(u_char const *pb, size_t len, u_char const *freq)
 		goto mem;
 	memcpy(pat->pat, pb, pat->patlen);
 						/* get skip delta */
-	if ((pat->delta = malloc(256 * sizeof(*d))) == NULL)
+	if ((pat->delta = calloc(256, sizeof(*d))) == NULL)
 		goto mem;
 	for (j = 0, d = pat->delta; j < 256; j++)
 		d[j] = pat->patlen;
diff --git a/lib/libevent/kqueue.c b/lib/libevent/kqueue.c
index c85334c29aa..89eb3356ad1 100644
--- a/lib/libevent/kqueue.c
+++ b/lib/libevent/kqueue.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kqueue.c,v 1.22 2007/03/19 15:12:49 millert Exp $	*/
+/*	$OpenBSD: kqueue.c,v 1.23 2007/09/02 15:19:18 deraadt Exp $	*/
 
 /*
  * Copyright 2000-2002 Niels Provos <provos@citi.umich.edu>
@@ -111,12 +111,12 @@ kq_init(void)
 	kqueueop->kq = kq;
 
 	/* Initalize fields */
-	kqueueop->changes = malloc(NEVENT * sizeof(struct kevent));
+	kqueueop->changes = calloc(NEVENT, sizeof(struct kevent));
 	if (kqueueop->changes == NULL) {
 		free (kqueueop);
 		return (NULL);
 	}
-	kqueueop->events = malloc(NEVENT * sizeof(struct kevent));
+	kqueueop->events = calloc(NEVENT, sizeof(struct kevent));
 	if (kqueueop->events == NULL) {
 		free (kqueueop->changes);
 		free (kqueueop);
diff --git a/lib/libpcap/optimize.c b/lib/libpcap/optimize.c
index 3c5fa1eb795..1e52e89bfd4 100644
--- a/lib/libpcap/optimize.c
+++ b/lib/libpcap/optimize.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: optimize.c,v 1.12 2006/04/02 21:38:57 djm Exp $	*/
+/*	$OpenBSD: optimize.c,v 1.13 2007/09/02 15:19:18 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1993, 1994, 1995, 1996
@@ -1806,7 +1806,7 @@ opt_init(root)
 	 */
 	unMarkAll();
 	n = count_blocks(root);
-	blocks = (struct block **)malloc(n * sizeof(*blocks));
+	blocks = (struct block **)calloc(n, sizeof(*blocks));
 	if (blocks == NULL)
 		bpf_error("malloc");
 	
@@ -1815,14 +1815,14 @@ opt_init(root)
 	number_blks_r(root);
 
 	n_edges = 2 * n_blocks;
-	edges = (struct edge **)malloc(n_edges * sizeof(*edges));
+	edges = (struct edge **)calloc(n_edges, sizeof(*edges));
 	if (edges == NULL)
 		bpf_error("malloc");
 
 	/*
 	 * The number of levels is bounded by the number of nodes.
 	 */
-	levels = (struct block **)malloc(n_blocks * sizeof(*levels));
+	levels = (struct block **)calloc(n_blocks, sizeof(*levels));
 	if (levels == NULL)
 		bpf_error("malloc");
 
@@ -1870,8 +1870,8 @@ opt_init(root)
 	 * we'll need.
 	 */
 	maxval = 3 * max_stmts;
-	vmap = (struct vmapinfo *)malloc(maxval * sizeof(*vmap));
-	vnode_base = (struct valnode *)malloc(maxval * sizeof(*vmap));
+	vmap = (struct vmapinfo *)calloc(maxval, sizeof(*vmap));
+	vnode_base = (struct valnode *)calloc(maxval, sizeof(*vmap));
 	if (vmap == NULL || vnode_base == NULL)
 		bpf_error("malloc");
 }
diff --git a/lib/libpcap/pcap.c b/lib/libpcap/pcap.c
index 6c516f39e32..9bf613921c0 100644
--- a/lib/libpcap/pcap.c
+++ b/lib/libpcap/pcap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pcap.c,v 1.10 2006/03/26 20:58:51 djm Exp $	*/
+/*	$OpenBSD: pcap.c,v 1.11 2007/09/02 15:19:18 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1993, 1994, 1995, 1996, 1997, 1998
@@ -209,7 +209,7 @@ pcap_list_datalinks(pcap_t *p, int **dlt_buffer)
 		**dlt_buffer = p->linktype;
 		return (1);
 	} else {
-		*dlt_buffer = (int*)malloc(sizeof(**dlt_buffer) * p->dlt_count);
+		*dlt_buffer = (int*)calloc(sizeof(**dlt_buffer), p->dlt_count);
 		if (*dlt_buffer == NULL) {
 			(void)snprintf(p->errbuf, sizeof(p->errbuf),
 			    "malloc: %s", pcap_strerror(errno));