? .gdbinit ? o ? patch ? patch.debug ? patch.html1 ? x Index: inp.c =================================================================== RCS file: /cvsroot/src/usr.bin/patch/inp.c,v retrieving revision 1.25 diff -u -u -r1.25 inp.c --- inp.c 16 Jun 2018 00:40:14 -0000 1.25 +++ inp.c 18 Jun 2018 18:31:38 -0000 @@ -118,11 +118,12 @@ static bool reallocate_lines(size_t *lines_allocated) { + char **p; size_t new_size; new_size = *lines_allocated * 3 / 2; - int res = reallocarr(&i_ptr, new_size + 2, sizeof(char *)); - if (res != 0) { /* shucks, it was a near thing */ + p = pch_realloc(i_ptr, new_size + 2, sizeof(char *)); + if (p == NULL) { /* shucks, it was a near thing */ munmap(i_womp, i_size); i_womp = NULL; free(i_ptr); @@ -131,6 +132,7 @@ return false; } *lines_allocated = new_size; + i_ptr = p; return true; } Index: pch.c =================================================================== RCS file: /cvsroot/src/usr.bin/patch/pch.c,v retrieving revision 1.29 diff -u -u -r1.29 pch.c --- pch.c 5 Apr 2018 18:50:10 -0000 1.29 +++ pch.c 18 Jun 2018 18:31:38 -0000 @@ -156,15 +156,15 @@ if (p_line == NULL || p_len == NULL || p_char == NULL) fatal("Internal memory allocation error\n"); - new_p_line = realloc(p_line, new_hunkmax * sizeof(char *)); + new_p_line = pch_realloc(p_line, new_hunkmax, sizeof(char *)); if (new_p_line == NULL) free(p_line); - new_p_len = realloc(p_len, new_hunkmax * sizeof(short)); + new_p_len = pch_realloc(p_len, new_hunkmax, sizeof(short)); if (new_p_len == NULL) free(p_len); - new_p_char = realloc(p_char, new_hunkmax * sizeof(char)); + new_p_char = pch_realloc(p_char, new_hunkmax, sizeof(char)); if (new_p_char == NULL) free(p_char); Index: util.c =================================================================== RCS file: /cvsroot/src/usr.bin/patch/util.c,v retrieving revision 1.27 diff -u -u -r1.27 util.c --- util.c 7 Nov 2015 18:11:21 -0000 1.27 +++ util.c 18 Jun 2018 18:31:38 -0000 @@ -435,3 +435,14 @@ unlink(TMPPATNAME); exit(status); } + + +void * +pch_realloc(void *ptr, size_t number, size_t size) +{ + if (number > SIZE_MAX / size) { + errno = EOVERFLOW; + return NULL; + } + return realloc(ptr, number * size); +} Index: util.h =================================================================== RCS file: /cvsroot/src/usr.bin/patch/util.h,v retrieving revision 1.12 diff -u -u -r1.12 util.h --- util.h 6 Sep 2011 18:25:14 -0000 1.12 +++ util.h 18 Jun 2018 18:31:38 -0000 @@ -45,6 +45,7 @@ void makedirs(const char *, bool); void version(void) __dead; void my_exit(int) __dead; +void *pch_realloc(void *, size_t, size_t); /* in mkpath.c */ extern int mkpath(char *);