diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 2007-09-02 15:19:41 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 2007-09-02 15:19:41 +0000 |
| commit | 6ebd04219f0d749c87a763e8afb578dfcd5223cc (patch) | |
| tree | bb0f29e0a3791fff88551c93f5d4ba7113bdba43 /usr.bin/vi | |
| parent | be524287dc216d876f995eddcaf32762c702c6e9 (diff) | |
use calloc() to avoid malloc(n * m) overflows; checked by djm canacar jsg
Diffstat (limited to 'usr.bin/vi')
| -rw-r--r-- | usr.bin/vi/cl/cl_read.c | 4 | ||||
| -rw-r--r-- | usr.bin/vi/ex/ex_script.c | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/usr.bin/vi/cl/cl_read.c b/usr.bin/vi/cl/cl_read.c index b2070f3c292..315806019ac 100644 --- a/usr.bin/vi/cl/cl_read.c +++ b/usr.bin/vi/cl/cl_read.c @@ -1,4 +1,4 @@ -/* $OpenBSD: cl_read.c,v 1.14 2007/07/26 16:11:56 millert Exp $ */ +/* $OpenBSD: cl_read.c,v 1.15 2007/09/02 15:19:35 deraadt Exp $ */ /*- * Copyright (c) 1993, 1994 @@ -159,7 +159,7 @@ cl_read(sp, flags, bp, blen, nrp, tp) CIRCLEQ_FOREACH(tsp, &gp->dq, q) if (F_ISSET(tsp, SC_SCRIPT) && tsp->script->sh_master > maxfd) maxfd = tsp->script->sh_master; - rdfd = (fd_set *)malloc(howmany(maxfd + 1, NFDBITS) * sizeof(fd_mask)); + rdfd = (fd_set *)calloc(howmany(maxfd + 1, NFDBITS), sizeof(fd_mask)); if (rdfd == NULL) goto err; diff --git a/usr.bin/vi/ex/ex_script.c b/usr.bin/vi/ex/ex_script.c index bb6bf982cd4..7852b7b7344 100644 --- a/usr.bin/vi/ex/ex_script.c +++ b/usr.bin/vi/ex/ex_script.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ex_script.c,v 1.13 2006/01/08 21:05:40 miod Exp $ */ +/* $OpenBSD: ex_script.c,v 1.14 2007/09/02 15:19:35 deraadt Exp $ */ /*- * Copyright (c) 1992, 1993, 1994 @@ -388,7 +388,7 @@ sscr_input(sp) CIRCLEQ_FOREACH(sp, &gp->dq, q) if (F_ISSET(sp, SC_SCRIPT) && sp->script->sh_master > maxfd) maxfd = sp->script->sh_master; - rdfd = (fd_set *)malloc(howmany(maxfd + 1, NFDBITS) * sizeof(fd_mask)); + rdfd = (fd_set *)calloc(howmany(maxfd + 1, NFDBITS), sizeof(fd_mask)); if (rdfd == NULL) { msgq(sp, M_SYSERR, "malloc"); return (1); |