Remove useless code that can cause a SEGV if a buffer is realloc()ed.

Allocate buffers early and in one place instead of two.
Fixes PR 5252; OK deraadt

1 files changed, 15 insertions, 46 deletions

diff --git a/usr.bin/sort/fsort.c b/usr.bin/sort/fsort.c
index 5baf3a0f94b..5f9485c20cf 100644
--- a/usr.bin/sort/fsort.c
+++ b/usr.bin/sort/fsort.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fsort.c,v 1.12 2004/09/14 22:57:58 deraadt Exp $	*/
+/*	$OpenBSD: fsort.c,v 1.13 2006/10/18 23:30:43 millert Exp $	*/
 
 /*-
  * Copyright (c) 1993
@@ -36,7 +36,7 @@
 #if 0
 static char sccsid[] = "@(#)fsort.c	8.1 (Berkeley) 6/6/93";
 #else
-static char rcsid[] = "$OpenBSD: fsort.c,v 1.12 2004/09/14 22:57:58 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: fsort.c,v 1.13 2006/10/18 23:30:43 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -53,8 +53,8 @@ static char rcsid[] = "$OpenBSD: fsort.c,v 1.12 2004/09/14 22:57:58 deraadt Exp
 #include <stdlib.h>
 #include <string.h>
 
-u_char **keylist = 0, *buffer = 0, *linebuf = 0;
-size_t bufsize, linebuf_size;
+u_char *buffer = NULL, *linebuf = NULL;
+size_t bufsize = BUFSIZE, linebuf_size = MAXLLEN;
 struct tempfile fstack[MAXFCT];
 extern char toutpath[];
 #define FSORTMAX 4
@@ -64,8 +64,8 @@ void
 fsort(int binno, int depth, union f_handle infiles, int nfiles, FILE *outfp,
     struct field *ftbl)
 {
-	u_char *bufend, **keypos, *tmpbuf;
-	u_char *weights;
+	u_char *bufend, *weights, **keypos, *tmpbuf;
+	static u_char **keylist;
 	int ntfiles, mfct = 0, total, i, maxb, lastb, panic = 0;
 	int c, nelem;
 	long sizes[NBINS+1];
@@ -85,18 +85,11 @@ fsort(int binno, int depth, union f_handle infiles, int nfiles, FILE *outfp,
 		tfield[0].weights = ascii;
 	tfield[0].icol.num = 1;
 	weights = ftbl[0].weights;
-	if (!buffer) {
-		bufsize = BUFSIZE;
-		if ((buffer = malloc(bufsize + 1)) == NULL ||
-		    (keylist = calloc(MAXNUM, sizeof(u_char *))) == NULL)
-			errx(2, "cannot allocate memory");
-		if (!SINGL_FLD) {
-			linebuf_size = MAXLLEN;
-			if ((linebuf = malloc(linebuf_size)) == NULL)
-				errx(2, "cannot allocate memory");
-		}
-	}
 	bufend = buffer + bufsize;
+	if (keylist == NULL) {
+		if ((keylist = calloc(MAXNUM, sizeof(u_char *))) == NULL)
+			err(2, NULL);
+	}
 	if (binno >= 0) {
 		tfiles.top = infiles.top + nfiles;
 		get = getnext;
@@ -140,9 +133,12 @@ fsort(int binno, int depth, union f_handle infiles, int nfiles, FILE *outfp,
 			 */
 			if (c == BUFFEND && nelem == 0) {
 				bufsize *= 2;
-				buffer = realloc(buffer, bufsize);
-				if (!buffer)
+				tmpbuf = realloc(buffer, bufsize);
+				if (!tmpbuf)
 					err(2, "failed to realloc buffer");
+				crec = (RECHEADER *)
+				    (tmpbuf + ((u_char *)crec - buffer));
+				buffer = tmpbuf;
 				bufend = buffer + bufsize;
 				continue;
 			}
@@ -157,27 +153,6 @@ fsort(int binno, int depth, union f_handle infiles, int nfiles, FILE *outfp,
 					mfct++;
 					/* reduce number of open files */
 					if (mfct == 16 ||(c == EOF && ntfiles)) {
-						/*
-						 * Only copy extra incomplete
-						 * crec data if there is any.
-						 */
-						int nodata = (bufend
-						    >= (u_char *)crec
-						    && bufend <= crec->data);
-						size_t sz = 0;
-
-						if (!nodata) {
-							sz = bufend
-							    - crec->data;
-							tmpbuf = malloc(sz);
-							if (tmpbuf == NULL)
-								errx(2, "cannot"
-								    " allocate"
-								    " memory");
-							memmove(tmpbuf,
-							    crec->data, sz);
-						}
-
 						fstack[tfiles.top + ntfiles].fp
 						    = ftmp();
 						fmerge(0, mstart, mfct, geteasy,
@@ -185,12 +160,6 @@ fsort(int binno, int depth, union f_handle infiles, int nfiles, FILE *outfp,
 						  putrec, ftbl);
 						ntfiles++;
 						mfct = 0;
-
-						if (!nodata) {
-							memmove(crec->data,
-							    tmpbuf, sz);
-							free(tmpbuf);
-						}
 					}
 				} else {
 					fstack[tfiles.top + ntfiles].fp= ftmp();