From OpenBSD: use calloc() to avoid malloc(n * m) overflows.

diff --git a/optimize.c b/optimize.c
index 5fc4926b79059cb5d24c0e2e26fedd1b04ac76fc..8a5c364773ea60af6532574358d613d15d6bee0c 100644 (file)
--- a/optimize.c
+++ b/optimize.c
@@ -22,7 +22,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.88 2007-07-15 19:53:54 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.89 2007-09-12 21:29:13 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -1983,7 +1983,7 @@ opt_init(root)
         */
        unMarkAll();
        n = count_blocks(root);
-       blocks = (struct block **)malloc(n * sizeof(*blocks));
+       blocks = (struct block **)calloc(n, sizeof(*blocks));
        if (blocks == NULL)
                bpf_error("malloc");
        unMarkAll();
@@ -1991,14 +1991,14 @@ opt_init(root)
        number_blks_r(root);
 
        n_edges = 2 * n_blocks;
-       edges = (struct edge **)malloc(n_edges * sizeof(*edges));
+       edges = (struct edge **)calloc(n_edges, sizeof(*edges));
        if (edges == NULL)
                bpf_error("malloc");
 
        /*
         * The number of levels is bounded by the number of nodes.
         */
-       levels = (struct block **)malloc(n_blocks * sizeof(*levels));
+       levels = (struct block **)calloc(n_blocks, sizeof(*levels));
        if (levels == NULL)
                bpf_error("malloc");
 
@@ -2045,8 +2045,8 @@ opt_init(root)
         * we'll need.
         */
        maxval = 3 * max_stmts;
-       vmap = (struct vmapinfo *)malloc(maxval * sizeof(*vmap));
-       vnode_base = (struct valnode *)malloc(maxval * sizeof(*vnode_base));
+       vmap = (struct vmapinfo *)calloc(maxval, sizeof(*vmap));
+       vnode_base = (struct valnode *)calloc(maxval, sizeof(*vnode_base));
        if (vmap == NULL || vnode_base == NULL)
                bpf_error("malloc");
 }

diff --git a/pcap.c b/pcap.c
index 3fd942086332d3428332a569698b2e52f45ccbba..e56c37fefbd40c4613b17398a1a3077f54f52a35 100644 (file)
--- a/pcap.c
+++ b/pcap.c
@@ -33,7 +33,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.108 2007-09-10 20:17:18 hannes Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.109 2007-09-12 21:32:11 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -240,7 +240,7 @@ pcap_list_datalinks(pcap_t *p, int **dlt_buffer)
                **dlt_buffer = p->linktype;
                return (1);
        } else {
-               *dlt_buffer = (int*)malloc(sizeof(**dlt_buffer) * p->dlt_count);
+               *dlt_buffer = (int*)calloc(sizeof(**dlt_buffer), p->dlt_count);
                if (*dlt_buffer == NULL) {
                        (void)snprintf(p->errbuf, sizeof(p->errbuf),
                            "malloc: %s", pcap_strerror(errno));