use calloc() to avoid malloc(n * m) overflows; checked by djm canacar jsg

19 files changed, 52 insertions, 51 deletions

diff --git a/sbin/atactl/atactl.c b/sbin/atactl/atactl.c
index 602b2f8f04a..6f82264ac63 100644
--- a/sbin/atactl/atactl.c
+++ b/sbin/atactl/atactl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: atactl.c,v 1.37 2006/10/02 19:30:19 jmc Exp $	*/
+/*	$OpenBSD: atactl.c,v 1.38 2007/09/02 15:19:23 deraadt Exp $	*/
 /*	$NetBSD: atactl.c,v 1.4 1999/02/24 18:49:14 jwise Exp $	*/
 
 /*-
@@ -1455,8 +1455,8 @@ device_smart_readlog(int argc, char *argv[])
 		 * the latest one.
 		 */
 		nsect = nerr / 5 + (nerr % 5 != 0 ? 1 : 0);
-		if ((newbuf = (u_int8_t *)malloc(nsect * DEV_BSIZE)) == NULL)
-			err(1, "malloc()");
+		if ((newbuf = (u_int8_t *)calloc(nsect, DEV_BSIZE)) == NULL)
+			err(1, "calloc()");
 		memset(&req, 0, sizeof(req));
 		req.flags = ATACMD_READ;
 		req.command = ATAPI_SMART;
diff --git a/sbin/ccdconfig/ccdconfig.c b/sbin/ccdconfig/ccdconfig.c
index e45ba95c7d9..4d9188f65c0 100644
--- a/sbin/ccdconfig/ccdconfig.c
+++ b/sbin/ccdconfig/ccdconfig.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ccdconfig.c,v 1.32 2007/08/06 19:16:05 sobrado Exp $	*/
+/*	$OpenBSD: ccdconfig.c,v 1.33 2007/09/02 15:19:23 deraadt Exp $	*/
 /*	$NetBSD: ccdconfig.c,v 1.6 1996/05/16 07:11:18 thorpej Exp $	*/
 
 /*-
@@ -278,7 +278,7 @@ do_single(int argc, char *argv[], int action)
 	}
 
 	/* Next is the list of disks to make the ccd from. */
-	disks = malloc(argc * sizeof(char *));
+	disks = calloc(argc, sizeof(char *));
 	if (disks == NULL) {
 		warnx("no memory to configure ccd");
 		goto done;
diff --git a/sbin/dhclient/dhclient.c b/sbin/dhclient/dhclient.c
index 9f07d8fb8b3..b3f6df739cd 100644
--- a/sbin/dhclient/dhclient.c
+++ b/sbin/dhclient/dhclient.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dhclient.c,v 1.114 2007/08/14 15:29:18 stevesk Exp $	*/
+/*	$OpenBSD: dhclient.c,v 1.115 2007/09/02 15:19:23 deraadt Exp $	*/
 
 /*
  * Copyright 2004 Henning Brauer <henning@openbsd.org>
@@ -1571,7 +1571,7 @@ priv_script_init(char *reason, char *medium)
 	client->scriptEnvsize = 100;
 	if (client->scriptEnv == NULL)
 		client->scriptEnv =
-		    malloc(client->scriptEnvsize * sizeof(char *));
+		    calloc(client->scriptEnvsize, sizeof(char *));
 	if (client->scriptEnv == NULL)
 		error("script_init: no memory for environment");
 
diff --git a/sbin/disklabel/editor.c b/sbin/disklabel/editor.c
index a347a9ebf61..96881391201 100644
--- a/sbin/disklabel/editor.c
+++ b/sbin/disklabel/editor.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: editor.c,v 1.124 2007/07/24 15:11:53 deraadt Exp $	*/
+/*	$OpenBSD: editor.c,v 1.125 2007/09/02 15:19:23 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1997-2000 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -17,7 +17,7 @@
  */
 
 #ifndef lint
-static char rcsid[] = "$OpenBSD: editor.c,v 1.124 2007/07/24 15:11:53 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: editor.c,v 1.125 2007/09/02 15:19:23 deraadt Exp $";
 #endif /* not lint */
 
 #include <sys/types.h>
@@ -1428,7 +1428,7 @@ sort_partitions(struct disklabel *lp, u_int16_t *npart)
 	}
 
 	/* Create an array of pointers to the partition data */
-	if ((spp = malloc(sizeof(struct partition *) * npartitions)) == NULL)
+	if ((spp = calloc(npartitions, sizeof(struct partition *))) == NULL)
 		errx(4, "out of memory");
 	for (npartitions = 0, i = 0; i < lp->d_npartitions; i++) {
 		if (lp->d_partitions[i].p_fstype != FS_UNUSED &&
diff --git a/sbin/dump/main.c b/sbin/dump/main.c
index ce24fd1224c..8995809a03d 100644
--- a/sbin/dump/main.c
+++ b/sbin/dump/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.41 2007/06/03 20:16:08 millert Exp $	*/
+/*	$OpenBSD: main.c,v 1.42 2007/09/02 15:19:23 deraadt Exp $	*/
 /*	$NetBSD: main.c,v 1.14 1997/06/05 11:13:24 lukem Exp $	*/
 
 /*-
@@ -40,7 +40,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)main.c	8.4 (Berkeley) 4/15/94";
 #else
-static const char rcsid[] = "$OpenBSD: main.c,v 1.41 2007/06/03 20:16:08 millert Exp $";
+static const char rcsid[] = "$OpenBSD: main.c,v 1.42 2007/09/02 15:19:23 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -652,7 +652,7 @@ obsolete(int *argcp, char **argvp[])
 		return;
 
 	/* Allocate space for new arguments. */
-	if ((*argvp = nargv = malloc((argc + 1) * sizeof(char *))) == NULL ||
+	if ((*argvp = nargv = calloc(argc + 1, sizeof(char *))) == NULL ||
 	    (p = flagsp = malloc(strlen(ap) + 2)) == NULL)
 		err(1, NULL);
 
diff --git a/sbin/fsck_ext2fs/setup.c b/sbin/fsck_ext2fs/setup.c
index e4c1637be70..06cc0dbdc82 100644
--- a/sbin/fsck_ext2fs/setup.c
+++ b/sbin/fsck_ext2fs/setup.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: setup.c,v 1.14 2007/05/29 06:28:15 otto Exp $	*/
+/*	$OpenBSD: setup.c,v 1.15 2007/09/02 15:19:23 deraadt Exp $	*/
 /*	$NetBSD: setup.c,v 1.1 1997/06/11 11:22:01 bouyer Exp $	*/
 
 /*
@@ -181,7 +181,7 @@ setup(char *dev)
 	 * read in the summary info.
 	 */
 
-	sblock.e2fs_gd = malloc(sblock.e2fs_ngdb * sblock.e2fs_bsize);
+	sblock.e2fs_gd = calloc(sblock.e2fs_ngdb, sblock.e2fs_bsize);
 	if (sblock.e2fs_gd == NULL)
 		errexit("out of memory\n");
 	asked = 0;
diff --git a/sbin/fsck_msdos/fat.c b/sbin/fsck_msdos/fat.c
index 29db725dbec..b7c05b4f4c0 100644
--- a/sbin/fsck_msdos/fat.c
+++ b/sbin/fsck_msdos/fat.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fat.c,v 1.16 2006/11/11 11:34:32 pedro Exp $	*/
+/*	$OpenBSD: fat.c,v 1.17 2007/09/02 15:19:23 deraadt Exp $	*/
 /*	$NetBSD: fat.c,v 1.8 1997/10/17 11:19:53 ws Exp $	*/
 
 /*
@@ -35,7 +35,7 @@
 
 
 #ifndef lint
-static char rcsid[] = "$OpenBSD: fat.c,v 1.16 2006/11/11 11:34:32 pedro Exp $";
+static char rcsid[] = "$OpenBSD: fat.c,v 1.17 2007/09/02 15:19:23 deraadt Exp $";
 #endif /* not lint */
 
 #include <stdlib.h>
@@ -95,7 +95,7 @@ readfat(int fs, struct bootblock *boot, int no, struct fatEntry **fp)
 
 	boot->NumFree = boot->NumBad = 0;
 	fat = calloc(boot->NumClusters, sizeof(struct fatEntry));
-	buffer = malloc(boot->FATsecs * boot->BytesPerSec);
+	buffer = calloc(boot->FATsecs, boot->BytesPerSec);
 	if (fat == NULL || buffer == NULL) {
 		xperror("No space for FAT");
 		if (fat != NULL)
@@ -432,7 +432,8 @@ writefat(int fs, struct bootblock *boot, struct fatEntry *fat)
 	off_t off;
 	int ret = FSOK;
 
-	buffer = malloc(fatsz = boot->FATsecs * boot->BytesPerSec);
+	fatsz = boot->FATsecs * boot->BytesPerSec;
+	buffer = calloc(boot->FATsecs, boot->BytesPerSec);
 	if (buffer == NULL) {
 		xperror("No space for FAT");
 		return (FSFATAL);
diff --git a/sbin/ifconfig/ifconfig.c b/sbin/ifconfig/ifconfig.c
index 44cd952f52a..6e7c2df97e4 100644
--- a/sbin/ifconfig/ifconfig.c
+++ b/sbin/ifconfig/ifconfig.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ifconfig.c,v 1.186 2007/08/25 20:05:30 henning Exp $	*/
+/*	$OpenBSD: ifconfig.c,v 1.187 2007/09/02 15:19:23 deraadt Exp $	*/
 /*	$NetBSD: ifconfig.c,v 1.40 1997/10/01 02:19:43 enami Exp $	*/
 
 /*
@@ -896,7 +896,7 @@ list_cloners(void)
 	if (ioctl(s, SIOCIFGCLONERS, &ifcr) == -1)
 		err(1, "SIOCIFGCLONERS for count");
 
-	buf = malloc(ifcr.ifcr_total * IFNAMSIZ);
+	buf = calloc(ifcr.ifcr_total, IFNAMSIZ);
 	if (buf == NULL)
 		err(1, "unable to allocate cloner name buffer");
 
@@ -2307,7 +2307,7 @@ status(int link, struct sockaddr_dl *sdl)
 		goto proto_status;
 	}
 
-	media_list = (int *)malloc(ifmr.ifm_count * sizeof(int));
+	media_list = (int *)calloc(ifmr.ifm_count, sizeof(int));
 	if (media_list == NULL)
 		err(1, "malloc");
 	ifmr.ifm_ulist = media_list;
diff --git a/sbin/isakmpd/ipsec.c b/sbin/isakmpd/ipsec.c
index ca531d396d0..df423c22d78 100644
--- a/sbin/isakmpd/ipsec.c
+++ b/sbin/isakmpd/ipsec.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ipsec.c,v 1.129 2007/07/31 20:59:33 hshoexer Exp $	 */
+/* $OpenBSD: ipsec.c,v 1.130 2007/09/02 15:19:24 deraadt Exp $	 */
 /* $EOM: ipsec.c,v 1.143 2000/12/11 23:57:42 niklas Exp $	 */
 
 /*
@@ -1632,7 +1632,7 @@ ipsec_handle_leftover_payload(struct message *msg, u_int8_t type,
 			    spisz, proto);
 			return -1;
 		}
-		spis = (u_int8_t *) malloc(nspis * spisz);
+		spis = (u_int8_t *) calloc(nspis, spisz);
 		if (!spis) {
 			log_error("ipsec_handle_leftover_payload: malloc "
 			    "(%d) failed", nspis * spisz);
diff --git a/sbin/isakmpd/pf_key_v2.c b/sbin/isakmpd/pf_key_v2.c
index 3efc74bc48b..7c55abb9e25 100644
--- a/sbin/isakmpd/pf_key_v2.c
+++ b/sbin/isakmpd/pf_key_v2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pf_key_v2.c,v 1.181 2007/05/27 18:31:30 claudio Exp $  */
+/* $OpenBSD: pf_key_v2.c,v 1.182 2007/09/02 15:19:24 deraadt Exp $  */
 /* $EOM: pf_key_v2.c,v 1.79 2000/12/12 00:33:19 niklas Exp $	 */
 
 /*
@@ -337,7 +337,7 @@ pf_key_v2_write(struct pf_key_v2_msg *pmsg)
 	struct sadb_msg *msg = TAILQ_FIRST(pmsg)->seg;
 	struct pf_key_v2_node *np = TAILQ_FIRST(pmsg);
 
-	iov = (struct iovec *) malloc(cnt * sizeof *iov);
+	iov = (struct iovec *) calloc(cnt, sizeof *iov);
 	if (!iov) {
 		log_error("pf_key_v2_write: malloc (%lu) failed",
 		    cnt * (unsigned long) sizeof *iov);
diff --git a/sbin/isakmpd/sa.c b/sbin/isakmpd/sa.c
index bf7c7b0f551..0bdcb2c4bb5 100644
--- a/sbin/isakmpd/sa.c
+++ b/sbin/isakmpd/sa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sa.c,v 1.112 2007/06/02 01:29:12 pvalchev Exp $	 */
+/* $OpenBSD: sa.c,v 1.113 2007/09/02 15:19:24 deraadt Exp $	 */
 /* $EOM: sa.c,v 1.112 2000/12/12 00:22:52 niklas Exp $	 */
 
 /*
@@ -88,7 +88,7 @@ sa_init(void)
 	int	i;
 
 	bucket_mask = (1 << INITIAL_BUCKET_BITS) - 1;
-	sa_tab = malloc((bucket_mask + 1) * sizeof(struct sa_list));
+	sa_tab = calloc(bucket_mask + 1, sizeof(struct sa_list));
 	if (!sa_tab)
 		log_fatal("sa_init: malloc (%lu) failed",
 		    (bucket_mask + 1) * (unsigned long)sizeof(struct sa_list));
diff --git a/sbin/isakmpd/x509.c b/sbin/isakmpd/x509.c
index 5fc0f91dcef..dfbf6446017 100644
--- a/sbin/isakmpd/x509.c
+++ b/sbin/isakmpd/x509.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509.c,v 1.110 2007/08/05 09:43:09 tom Exp $	 */
+/* $OpenBSD: x509.c,v 1.111 2007/09/02 15:19:24 deraadt Exp $	 */
 /* $EOM: x509.c,v 1.54 2001/01/16 18:42:16 ho Exp $	 */
 
 /*
@@ -482,7 +482,7 @@ x509_hash_init(void)
 			}
 		free(x509_tab);
 	}
-	x509_tab = malloc((bucket_mask + 1) * sizeof(struct x509_list));
+	x509_tab = calloc(bucket_mask + 1, sizeof(struct x509_list));
 	if (!x509_tab)
 		log_fatal("x509_hash_init: malloc (%lu) failed",
 		    (bucket_mask + 1) *
@@ -1149,7 +1149,7 @@ x509_cert_get_subjects(void *scert, int *cnt, u_int8_t ***id,
 		    *cnt * (unsigned long)sizeof **id);
 		goto fail;
 	}
-	*id_len = malloc(*cnt * sizeof **id_len);
+	*id_len = calloc(*cnt, sizeof **id_len);
 	if (!*id_len) {
 		log_print("x509_cert_get_subject: malloc (%lu) failed",
 		    *cnt * (unsigned long)sizeof **id_len);
diff --git a/sbin/mount/mount.c b/sbin/mount/mount.c
index a64b98b50b6..9b99c559a25 100644
--- a/sbin/mount/mount.c
+++ b/sbin/mount/mount.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mount.c,v 1.45 2007/06/01 05:37:14 deraadt Exp $	*/
+/*	$OpenBSD: mount.c,v 1.46 2007/09/02 15:19:24 deraadt Exp $	*/
 /*	$NetBSD: mount.c,v 1.24 1995/11/18 03:34:29 cgd Exp $	*/
 
 /*
@@ -40,7 +40,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)mount.c	8.19 (Berkeley) 4/19/94";
 #else
-static char rcsid[] = "$OpenBSD: mount.c,v 1.45 2007/06/01 05:37:14 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: mount.c,v 1.46 2007/09/02 15:19:24 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -390,7 +390,7 @@ mountfs(const char *vfstype, const char *spec, const char *name,
 	}
 
 	argvsize = 64;
-	if((argv = malloc(argvsize * sizeof(char*))) == NULL)
+	if((argv = calloc(argvsize, sizeof(char *))) == NULL)
 		err(1, "malloc");
 	argc = 0;
 	argv[argc++] = NULL;	/* this should be a full path name */
@@ -652,7 +652,7 @@ maketypelist(char *fslist)
 		++nextcp;
 
 	/* Build an array of that many types. */
-	if ((av = typelist = malloc((i + 1) * sizeof(char *))) == NULL)
+	if ((av = typelist = calloc(i + 1, sizeof(char *))) == NULL)
 		err(1, NULL);
 	av[0] = fslist;
 	for (i = 1, nextcp = fslist; (nextcp = strchr(nextcp, ',')); i++) {
diff --git a/sbin/mount_vnd/pkcs5_pbkdf2.c b/sbin/mount_vnd/pkcs5_pbkdf2.c
index b88ee815b8e..75e9f7ac705 100644
--- a/sbin/mount_vnd/pkcs5_pbkdf2.c
+++ b/sbin/mount_vnd/pkcs5_pbkdf2.c
@@ -155,7 +155,7 @@ pkcs5_pbkdf2(u_int8_t **r, int dkLen, const u_int8_t *P, int Plen,
 	l = (dkLen + PRF_BLOCKLEN - 1) / PRF_BLOCKLEN;
 
 	/* allocate the output */
-	*r = malloc(l * PRF_BLOCKLEN);
+	*r = calloc(l, PRF_BLOCKLEN);
 	if (!*r)
 		return -1;
 
diff --git a/sbin/raidctl/raidctl.c b/sbin/raidctl/raidctl.c
index 2f46e630009..6b2ce6aa782 100644
--- a/sbin/raidctl/raidctl.c
+++ b/sbin/raidctl/raidctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raidctl.c,v 1.27 2007/02/21 16:33:09 jmc Exp $	*/
+/*	$OpenBSD: raidctl.c,v 1.28 2007/09/02 15:19:24 deraadt Exp $	*/
 /*      $NetBSD: raidctl.c,v 1.27 2001/07/10 01:30:52 lukem Exp $   */
 
 /*-
@@ -1159,7 +1159,7 @@ open_device(fdidpair **devfd, char *name)
 		}
 	}
 
-	if ((*devfd = malloc(nfd * sizeof(fdidpair))) == NULL)
+	if ((*devfd = calloc(nfd, sizeof(fdidpair))) == NULL)
 		errx(1, "malloc() error");
 
 	i = nfd;
@@ -1205,7 +1205,7 @@ get_all_devices(char ***diskarray, const char *genericname)
 		fp++;
 	}
 
-	*diskarray = (char**) malloc(numdevs * sizeof(void*));
+	*diskarray = (char**) calloc(numdevs, sizeof(void*));
 	i = 0;
 	fp = disks;
 	while ((p = strsep(&fp, ",")) != NULL) {
diff --git a/sbin/restore/interactive.c b/sbin/restore/interactive.c
index 69624bfcda6..860de17dab2 100644
--- a/sbin/restore/interactive.c
+++ b/sbin/restore/interactive.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: interactive.c,v 1.23 2005/06/16 14:51:21 millert Exp $	*/
+/*	$OpenBSD: interactive.c,v 1.24 2007/09/02 15:19:25 deraadt Exp $	*/
 /*	$NetBSD: interactive.c,v 1.10 1997/03/19 08:42:52 lukem Exp $	*/
 
 /*
@@ -34,7 +34,7 @@
 #if 0
 static char sccsid[] = "@(#)interactive.c	8.3 (Berkeley) 9/13/94";
 #else
-static const char rcsid[] = "$OpenBSD: interactive.c,v 1.23 2005/06/16 14:51:21 millert Exp $";
+static const char rcsid[] = "$OpenBSD: interactive.c,v 1.24 2007/09/02 15:19:25 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -535,7 +535,7 @@ printlist(char *name, char *basename)
 		while ((dp = rst_readdir(dirp)))
 			entries++;
 		rst_closedir(dirp);
-		list = (struct afile *)malloc(entries * sizeof(struct afile));
+		list = (struct afile *)calloc(entries, sizeof(struct afile));
 		if (list == NULL) {
 			fprintf(stderr, "ls: out of memory\n");
 			return;
diff --git a/sbin/restore/main.c b/sbin/restore/main.c
index 14c66079b06..d9c26573e78 100644
--- a/sbin/restore/main.c
+++ b/sbin/restore/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.17 2007/02/25 16:41:42 jmc Exp $	*/
+/*	$OpenBSD: main.c,v 1.18 2007/09/02 15:19:25 deraadt Exp $	*/
 /*	$NetBSD: main.c,v 1.13 1997/07/01 05:37:51 lukem Exp $	*/
 
 /*
@@ -40,7 +40,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)main.c	8.3 (Berkeley) 9/13/94";
 #else
-static const char rcsid[] = "$OpenBSD: main.c,v 1.17 2007/02/25 16:41:42 jmc Exp $";
+static const char rcsid[] = "$OpenBSD: main.c,v 1.18 2007/09/02 15:19:25 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -312,7 +312,7 @@ obsolete(int *argcp, char **argvp[])
 		return;
 
 	/* Allocate space for new arguments. */
-	if ((*argvp = nargv = malloc((argc + 1) * sizeof(char *))) == NULL ||
+	if ((*argvp = nargv = calloc(argc + 1, sizeof(char *))) == NULL ||
 	    (p = flagsp = malloc(strlen(ap) + 2)) == NULL)
 		err(1, NULL);
 
diff --git a/sbin/restore/tape.c b/sbin/restore/tape.c
index 0ea205899bc..0120d703290 100644
--- a/sbin/restore/tape.c
+++ b/sbin/restore/tape.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tape.c,v 1.32 2007/06/03 20:16:08 millert Exp $	*/
+/*	$OpenBSD: tape.c,v 1.33 2007/09/02 15:19:25 deraadt Exp $	*/
 /*	$NetBSD: tape.c,v 1.26 1997/04/15 07:12:25 lukem Exp $	*/
 
 /*
@@ -39,7 +39,7 @@
 #if 0
 static char sccsid[] = "@(#)tape.c	8.6 (Berkeley) 9/13/94";
 #else
-static const char rcsid[] = "$OpenBSD: tape.c,v 1.32 2007/06/03 20:16:08 millert Exp $";
+static const char rcsid[] = "$OpenBSD: tape.c,v 1.33 2007/09/02 15:19:25 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -183,7 +183,7 @@ newtapebuf(long size)
 		return;
 	if (tapebuf != NULL)
 		free(tapebuf);
-	tapebuf = malloc(size * TP_BSIZE);
+	tapebuf = calloc(size, TP_BSIZE);
 	if (tapebuf == NULL)
 		errx(1, "Cannot allocate space for tape buffer");
 	tapebufsize = size;
diff --git a/sbin/umount/umount.c b/sbin/umount/umount.c
index d69bb9b1cbc..9e8b8bef803 100644
--- a/sbin/umount/umount.c
+++ b/sbin/umount/umount.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: umount.c,v 1.18 2007/01/28 16:23:58 bluhm Exp $	*/
+/*	$OpenBSD: umount.c,v 1.19 2007/09/02 15:19:25 deraadt Exp $	*/
 /*	$NetBSD: umount.c,v 1.16 1996/05/11 14:13:55 mycroft Exp $	*/
 
 /*-
@@ -40,7 +40,7 @@ static char copyright[] =
 #if 0
 static char sccsid[] = "@(#)umount.c	8.3 (Berkeley) 2/20/94";
 #else
-static char rcsid[] = "$OpenBSD: umount.c,v 1.18 2007/01/28 16:23:58 bluhm Exp $";
+static char rcsid[] = "$OpenBSD: umount.c,v 1.19 2007/09/02 15:19:25 deraadt Exp $";
 #endif
 #endif /* not lint */
 
@@ -335,7 +335,7 @@ maketypelist(char *fslist)
 		++nextcp;
 
 	/* Build an array of that many types. */
-	if ((av = typelist = malloc((i + 1) * sizeof(char *))) == NULL)
+	if ((av = typelist = calloc(i + 1, sizeof(char *))) == NULL)
 		err(1, NULL);
 	av[0] = fslist;
 	for (i = 1, nextcp = fslist; (nextcp = strchr(nextcp, ',')); i++) {