malloc bugs with tcpdump

[Ulrich Spoerlein]

Sam Leffler wrote:
> I sent the attached patch upstream to the tcpdump folks.  Once I hear back I'll commit it.
> 
> 	Sam

> Index: pcap-bpf.c
> ===================================================================
> RCS file: /usr/ncvs/src/contrib/libpcap/pcap-bpf.c,v
> retrieving revision 1.1.1.10
> diff -u -r1.1.1.10 pcap-bpf.c
> --- pcap-bpf.c	11 Jul 2005 03:24:42 -0000	1.1.1.10
> +++ pcap-bpf.c	16 Jan 2006 05:48:49 -0000
> @@ -746,7 +746,7 @@
>  		u_int i;
>  		int is_ethernet;
>  
> -		bdl.bfl_list = (u_int *) malloc(sizeof(u_int) * bdl.bfl_len + 1);
> +		bdl.bfl_list = (u_int *) malloc(sizeof(u_int) * (bdl.bfl_len + 1));
>  		if (bdl.bfl_list == NULL) {
>  			(void)snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
>  			    pcap_strerror(errno));

Hi Sam,

heh, I was trying to figure this one out earlier, but I gave up after
a couple of minutes, as I couldn't figure out why in god's name the
malloc would be too small to produce an error. Nice catch.

Ulrich Spoerlein
-- 
 PGP Key ID: F0DB9F44				Encrypted mail welcome!
Fingerprint: F1CE D062 0CA9 ADE3 349B  2FE8 980A C6B5 F0DB 9F44
Which is worse: ignorance or apathy?
Don't know. Don't care.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20060116/5d07a43a/attachment.bin