realloc fixes; ok deraadt millert

4 files changed, 52 insertions, 21 deletions

diff --git a/usr.sbin/dhcp/dhclient/dhclient.c b/usr.sbin/dhcp/dhclient/dhclient.c
index 67c74af97a6..ae3786cc175 100644
--- a/usr.sbin/dhcp/dhclient/dhclient.c
+++ b/usr.sbin/dhcp/dhclient/dhclient.c
@@ -2149,11 +2149,18 @@ void script_set_env (client, prefix, name, value)
 	} else {
 		/* New variable.  Expand if necessary. */
 		if (i >= client->scriptEnvsize - 1) {
-			client->scriptEnvsize += 50;
-			client->scriptEnv = realloc(client->scriptEnv,
-		          client->scriptEnvsize);
-			if (client->scriptEnv == NULL)
+			char **newscriptEnv;
+			int newscriptEnvsize = client->scriptEnvsize + 50;
+			newscriptEnv = realloc(client->scriptEnv,
+		          newscriptEnvsize);
+			if (newscriptEnv == NULL) {
+				free(client->scriptEnv);
+				client->scriptEnv = NULL;
+				client->scriptEnvsize = 0;
 				error("script_set_env: no memory for variable");
+			}
+			client->scriptEnv = newscriptEnv;
+			client->scriptEnvsize = newscriptEnvsize;
 		}
 		/* need to set the NULL pointer at end of array beyond
 		   the new slot. */
diff --git a/usr.sbin/lpr/common_source/common.c b/usr.sbin/lpr/common_source/common.c
index ac3527e4184..8f6ff38f778 100644
--- a/usr.sbin/lpr/common_source/common.c
+++ b/usr.sbin/lpr/common_source/common.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: common.c,v 1.25 2003/06/02 23:36:53 millert Exp $	*/
+/*	$OpenBSD: common.c,v 1.26 2003/09/26 06:01:41 pvalchev Exp $	*/
 /*	$NetBSD: common.c,v 1.21 2000/08/09 14:28:50 itojun Exp $	*/
 
 /*
@@ -39,7 +39,7 @@
 #if 0
 static const char sccsid[] = "@(#)common.c	8.5 (Berkeley) 4/28/95";
 #else
-static const char rcsid[] = "$OpenBSD: common.c,v 1.25 2003/06/02 23:36:53 millert Exp $";
+static const char rcsid[] = "$OpenBSD: common.c,v 1.26 2003/09/26 06:01:41 pvalchev Exp $";
 #endif
 #endif /* not lint */
 
@@ -281,11 +281,17 @@ getq(struct queue ***namelist)
 		 * realloc the maximum size.
 		 */
 		if (++nitems > arraysz) {
-			arraysz *= 2;
-			queue = (struct queue **)realloc(queue,
-				arraysz * sizeof(struct queue *));
-			if (queue == NULL)
+			struct queue **newqueue;
+			size_t newarraysz = arraysz * 2;
+			newqueue = (struct queue **)realloc(queue,
+				newarraysz * sizeof(struct queue *));
+			if (newqueue == NULL) {
+				free(queue);
+				queue = NULL;
 				goto errdone;
+			}
+			queue = newqueue;
+			arraysz = newarraysz;
 		}
 		queue[nitems-1] = q;
 	}
diff --git a/usr.sbin/lpr/lpd/lpd.c b/usr.sbin/lpr/lpd/lpd.c
index d176c432bbf..cf120480967 100644
--- a/usr.sbin/lpr/lpd/lpd.c
+++ b/usr.sbin/lpr/lpd/lpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lpd.c,v 1.40 2003/09/03 20:23:26 tedu Exp $ */
+/*	$OpenBSD: lpd.c,v 1.41 2003/09/26 06:01:42 pvalchev Exp $ */
 /*	$NetBSD: lpd.c,v 1.33 2002/01/21 14:42:29 wiz Exp $	*/
 
 /*
@@ -41,7 +41,7 @@ static const char copyright[] =
 #if 0
 static const char sccsid[] = "@(#)lpd.c	8.7 (Berkeley) 5/10/95";
 #else
-static const char rcsid[] = "$OpenBSD: lpd.c,v 1.40 2003/09/03 20:23:26 tedu Exp $";
+static const char rcsid[] = "$OpenBSD: lpd.c,v 1.41 2003/09/26 06:01:42 pvalchev Exp $";
 #endif
 #endif /* not lint */
 
@@ -171,11 +171,23 @@ main(int argc, char **argv)
 		switch (i) {
 		case 'b':
 			if (blist_addrs >= blist_size) {
-				blist_size += sizeof(char *) * 4;
-				if (blist == NULL)
+				if (blist == NULL) {
+					blist_size += sizeof(char *) * 4;
 					blist = malloc(blist_size);
-				else
-					blist = realloc(blist, blist_size);
+				}
+				else {
+					char **newblist;
+					int newblist_size = blist_size +
+					    sizeof(char *) * 4;
+					newblist = realloc(blist, newblist_size);
+					if (newblist == NULL) {
+						free(blist);
+						blist_size = 0;
+						blist = NULL;
+					}
+					blist = newblist;
+					blist_size = newblist_size;
+				}
 				if (blist == NULL)
 					err(1, "cant allocate bind addr list");
 			}
diff --git a/usr.sbin/pppd/auth.c b/usr.sbin/pppd/auth.c
index b00dcaa79e0..f303847e2f4 100644
--- a/usr.sbin/pppd/auth.c
+++ b/usr.sbin/pppd/auth.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: auth.c,v 1.29 2003/04/16 07:44:04 tedu Exp $	*/
+/*	$OpenBSD: auth.c,v 1.30 2003/09/26 06:01:42 pvalchev Exp $	*/
 
 /*
  * auth.c - PPP authentication and phase control.
@@ -77,7 +77,7 @@
 #if 0
 static char rcsid[] = "Id: auth.c,v 1.37 1998/03/26 04:46:03 paulus Exp $";
 #else
-static char rcsid[] = "$OpenBSD: auth.c,v 1.29 2003/04/16 07:44:04 tedu Exp $";
+static char rcsid[] = "$OpenBSD: auth.c,v 1.30 2003/09/26 06:01:42 pvalchev Exp $";
 #endif
 #endif
 
@@ -765,10 +765,16 @@ static int pam_conv (int num_msg,
 
     for (count = 0; count < num_msg; count++)
       {
-	size += sizeof (struct pam_response);
-	reply = realloc (reply, size); /* ANSI: is malloc() if reply==NULL */
-	if (!reply)
+	struct pam_response *newreply;
+	int newsize = size + sizeof (struct pam_response);
+	newreply = realloc (reply, newsize); /* ANSI: is malloc() if reply==NULL */
+	if (!newreply) {
+	    free(reply);
+	    reply = NULL;
 	    return PAM_CONV_ERR;
+	}
+	reply = newreply;
+	size = newsize;
 
 	switch (msg[count]->msg_style)
 	  {