Remove 'usb_'realloc() usage because it doesn't know the size of the old

buffer, thus may copy too much, causing a memory fault.
ok millert, dlg, henning, tdeval, otto

3 files changed, 18 insertions, 26 deletions

diff --git a/sys/dev/usb/uaudio.c b/sys/dev/usb/uaudio.c
index 68bfd7b1cc5..b43b5dab7a5 100644
--- a/sys/dev/usb/uaudio.c
+++ b/sys/dev/usb/uaudio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uaudio.c,v 1.19 2004/07/08 22:18:44 deraadt Exp $ */
+/*	$OpenBSD: uaudio.c,v 1.20 2004/08/30 03:06:48 drahn Exp $ */
 /*	$NetBSD: uaudio.c,v 1.67 2003/05/03 18:11:41 wiz Exp $	*/
 
 /*
@@ -573,14 +573,19 @@ uaudio_mixer_add_ctl(struct uaudio_softc *sc, struct mixerctl *mc)
 {
 	int res;
 	size_t len = sizeof(*mc) * (sc->sc_nctls + 1);
-	struct mixerctl *nmc = sc->sc_nctls == 0 ?
-	    malloc(len, M_USBDEV, M_NOWAIT) :
-	    realloc(sc->sc_ctls, len, M_USBDEV, M_NOWAIT);
+	struct mixerctl *nmc = malloc(len, M_USBDEV, M_NOWAIT);
 
 	if (nmc == NULL) {
 		printf("uaudio_mixer_add_ctl: no memory\n");
 		return;
 	}
+
+	/* Copy old data, if there was any */
+	if (sc->sc_nctls != 0) {
+	    bcopy(sc->sc_ctls, nmc, sizeof(*mc) * (sc->sc_nctls));
+	    free(sc->sc_ctls, M_USBDEV);
+	}
+
 	sc->sc_ctls = nmc;
 
 	mc->delta = 0;
@@ -1079,15 +1084,19 @@ void
 uaudio_add_alt(struct uaudio_softc *sc, struct as_info *ai)
 {
 	size_t len = sizeof(*ai) * (sc->sc_nalts + 1);
-	struct as_info *nai = (sc->sc_nalts == 0) ?
-	    malloc(len, M_USBDEV, M_NOWAIT) :
-	    realloc(sc->sc_alts, len, M_USBDEV, M_NOWAIT);
+	struct as_info *nai = malloc(len, M_USBDEV, M_NOWAIT);
 
 	if (nai == NULL) {
 		printf("uaudio_add_alt: no memory\n");
 		return;
 	}
 
+	/* Copy old data, if there was any */
+	if (sc->sc_nalts != 0) { 
+	    bcopy(sc->sc_alts, nai, sizeof(*ai) * (sc->sc_nalts));
+	    free(sc->sc_alts, M_USBDEV);
+	}
+
 	sc->sc_alts = nai;
 	DPRINTFN(2,("uaudio_add_alt: adding alt=%d, enc=%d\n",
 		    ai->alt, ai->encoding));
diff --git a/sys/dev/usb/usb_port.h b/sys/dev/usb/usb_port.h
index 46b14e7579f..50d58327ce6 100644
--- a/sys/dev/usb/usb_port.h
+++ b/sys/dev/usb/usb_port.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usb_port.h,v 1.49 2004/05/26 04:26:58 deraadt Exp $ */
+/*	$OpenBSD: usb_port.h,v 1.50 2004/08/30 03:06:48 drahn Exp $ */
 /*	$NetBSD: usb_port.h,v 1.62 2003/02/15 18:33:30 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/usb_port.h,v 1.21 1999/11/17 22:33:47 n_hibma Exp $	*/
 
@@ -296,9 +296,6 @@ typedef int usb_malloc_type;
 #define slinear16_to_ulinear8_le linear16_to_ulinear8_le
 #define slinear16_to_ulinear8_be linear16_to_ulinear8_be
 
-#define realloc usb_realloc
-void *usb_realloc(void *, u_int, int, int);
-
 typedef struct device *device_ptr_t;
 #define USBBASEDEVICE struct device
 #define USBDEV(bdev) (&(bdev))
diff --git a/sys/dev/usb/usb_subr.c b/sys/dev/usb/usb_subr.c
index 73b2ad0d103..2e6895ee421 100644
--- a/sys/dev/usb/usb_subr.c
+++ b/sys/dev/usb/usb_subr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: usb_subr.c,v 1.27 2004/07/08 22:18:45 deraadt Exp $ */
+/*	$OpenBSD: usb_subr.c,v 1.28 2004/08/30 03:06:48 drahn Exp $ */
 /*	$NetBSD: usb_subr.c,v 1.103 2003/01/10 11:19:13 augustss Exp $	*/
 /*	$FreeBSD: src/sys/dev/usb/usb_subr.c,v 1.18 1999/11/17 22:33:47 n_hibma Exp $	*/
 
@@ -1383,17 +1383,3 @@ usb_disconnect_port(struct usbd_port *up, device_ptr_t parent)
 	up->device = NULL;
 	usb_free_device(dev);
 }
-
-#ifdef __OpenBSD__
-void *usb_realloc(void *p, u_int size, int pool, int flags)
-{
-	void *q;
-
-	q = malloc(size, pool, flags);
-	if (q == NULL)
-		return (NULL);
-	bcopy(p, q, size);
-	free(p, pool);
-	return (q);
-}
-#endif