From OpenBSD: use calloc() to avoid malloc(n * m) overflows.

diff --git a/optimize.c b/optimize.c
index 75a61391fb8f16b53be1c9c39110c20739367bd7..260faa21c5c9657d22c187f3a0020ca9331100b2 100644 (file)
--- a/optimize.c
+++ b/optimize.c
@@ -22,7 +22,7 @@
  */
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.85.2.2 2007-07-15 19:55:04 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/optimize.c,v 1.85.2.3 2007-09-12 21:29:45 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -1972,7 +1972,7 @@ opt_init(root)
         */
        unMarkAll();
        n = count_blocks(root);
-       blocks = (struct block **)malloc(n * sizeof(*blocks));
+       blocks = (struct block **)calloc(n, sizeof(*blocks));
        if (blocks == NULL)
                bpf_error("malloc");
        unMarkAll();
@@ -1980,14 +1980,14 @@ opt_init(root)
        number_blks_r(root);
 
        n_edges = 2 * n_blocks;
-       edges = (struct edge **)malloc(n_edges * sizeof(*edges));
+       edges = (struct edge **)calloc(n_edges, sizeof(*edges));
        if (edges == NULL)
                bpf_error("malloc");
 
        /*
         * The number of levels is bounded by the number of nodes.
         */
-       levels = (struct block **)malloc(n_blocks * sizeof(*levels));
+       levels = (struct block **)calloc(n_blocks, sizeof(*levels));
        if (levels == NULL)
                bpf_error("malloc");
 
@@ -2034,8 +2034,8 @@ opt_init(root)
         * we'll need.
         */
        maxval = 3 * max_stmts;
-       vmap = (struct vmapinfo *)malloc(maxval * sizeof(*vmap));
-       vnode_base = (struct valnode *)malloc(maxval * sizeof(*vnode_base));
+       vmap = (struct vmapinfo *)calloc(maxval, sizeof(*vmap));
+       vnode_base = (struct valnode *)calloc(maxval, sizeof(*vnode_base));
        if (vmap == NULL || vnode_base == NULL)
                bpf_error("malloc");
 }

diff --git a/pcap.c b/pcap.c
index 44ceb843f878f802fb53c33ae8390d5c059bde8a..1503814d152ddbebe1fffc6dd5e5987002dace40 100644 (file)
--- a/pcap.c
+++ b/pcap.c
@@ -33,7 +33,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.88.2.17 2007-06-22 06:43:58 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.88.2.18 2007-09-12 21:33:36 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -240,7 +240,7 @@ pcap_list_datalinks(pcap_t *p, int **dlt_buffer)
                **dlt_buffer = p->linktype;
                return (1);
        } else {
-               *dlt_buffer = (int*)malloc(sizeof(**dlt_buffer) * p->dlt_count);
+               *dlt_buffer = (int*)calloc(sizeof(**dlt_buffer), p->dlt_count);
                if (*dlt_buffer == NULL) {
                        (void)snprintf(p->errbuf, sizeof(p->errbuf),
                            "malloc: %s", pcap_strerror(errno));