realloc fixes; ok deraadt millert

2 files changed, 30 insertions, 12 deletions

diff --git a/usr.sbin/lpr/common_source/common.c b/usr.sbin/lpr/common_source/common.c
index ac3527e4184..8f6ff38f778 100644
--- a/usr.sbin/lpr/common_source/common.c
+++ b/usr.sbin/lpr/common_source/common.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: common.c,v 1.25 2003/06/02 23:36:53 millert Exp $	*/
+/*	$OpenBSD: common.c,v 1.26 2003/09/26 06:01:41 pvalchev Exp $	*/
 /*	$NetBSD: common.c,v 1.21 2000/08/09 14:28:50 itojun Exp $	*/
 
 /*
@@ -39,7 +39,7 @@
 #if 0
 static const char sccsid[] = "@(#)common.c	8.5 (Berkeley) 4/28/95";
 #else
-static const char rcsid[] = "$OpenBSD: common.c,v 1.25 2003/06/02 23:36:53 millert Exp $";
+static const char rcsid[] = "$OpenBSD: common.c,v 1.26 2003/09/26 06:01:41 pvalchev Exp $";
 #endif
 #endif /* not lint */
 
@@ -281,11 +281,17 @@ getq(struct queue ***namelist)
 		 * realloc the maximum size.
 		 */
 		if (++nitems > arraysz) {
-			arraysz *= 2;
-			queue = (struct queue **)realloc(queue,
-				arraysz * sizeof(struct queue *));
-			if (queue == NULL)
+			struct queue **newqueue;
+			size_t newarraysz = arraysz * 2;
+			newqueue = (struct queue **)realloc(queue,
+				newarraysz * sizeof(struct queue *));
+			if (newqueue == NULL) {
+				free(queue);
+				queue = NULL;
 				goto errdone;
+			}
+			queue = newqueue;
+			arraysz = newarraysz;
 		}
 		queue[nitems-1] = q;
 	}
diff --git a/usr.sbin/lpr/lpd/lpd.c b/usr.sbin/lpr/lpd/lpd.c
index d176c432bbf..cf120480967 100644
--- a/usr.sbin/lpr/lpd/lpd.c
+++ b/usr.sbin/lpr/lpd/lpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lpd.c,v 1.40 2003/09/03 20:23:26 tedu Exp $ */
+/*	$OpenBSD: lpd.c,v 1.41 2003/09/26 06:01:42 pvalchev Exp $ */
 /*	$NetBSD: lpd.c,v 1.33 2002/01/21 14:42:29 wiz Exp $	*/
 
 /*
@@ -41,7 +41,7 @@ static const char copyright[] =
 #if 0
 static const char sccsid[] = "@(#)lpd.c	8.7 (Berkeley) 5/10/95";
 #else
-static const char rcsid[] = "$OpenBSD: lpd.c,v 1.40 2003/09/03 20:23:26 tedu Exp $";
+static const char rcsid[] = "$OpenBSD: lpd.c,v 1.41 2003/09/26 06:01:42 pvalchev Exp $";
 #endif
 #endif /* not lint */
 
@@ -171,11 +171,23 @@ main(int argc, char **argv)
 		switch (i) {
 		case 'b':
 			if (blist_addrs >= blist_size) {
-				blist_size += sizeof(char *) * 4;
-				if (blist == NULL)
+				if (blist == NULL) {
+					blist_size += sizeof(char *) * 4;
 					blist = malloc(blist_size);
-				else
-					blist = realloc(blist, blist_size);
+				}
+				else {
+					char **newblist;
+					int newblist_size = blist_size +
+					    sizeof(char *) * 4;
+					newblist = realloc(blist, newblist_size);
+					if (newblist == NULL) {
+						free(blist);
+						blist_size = 0;
+						blist = NULL;
+					}
+					blist = newblist;
+					blist_size = newblist_size;
+				}
 				if (blist == NULL)
 					err(1, "cant allocate bind addr list");
 			}