svn commit: r314877 - head/usr.sbin/lpr/common_source

[Pedro F. Giffuni]

Author: pfg
Date: Tue Mar  7 19:30:22 2017
New Revision: 314877
URL: https://svnweb.freebsd.org/changeset/base/314877

Log:
  lpr(1): small bounds check with reallocarray(3).
  
  While here plug a memory leak upon error and postpose a multiplication
  until after reallocation has succeded.
  
  Hinted partially by:	OpenBSD
  Reviewed by:		gad
  MFC after:		2 weeks

Modified:
  head/usr.sbin/lpr/common_source/common.c

Modified: head/usr.sbin/lpr/common_source/common.c
==============================================================================
--- head/usr.sbin/lpr/common_source/common.c	Tue Mar  7 19:00:50 2017	(r314876)
+++ head/usr.sbin/lpr/common_source/common.c	Tue Mar  7 19:30:22 2017	(r314877)
@@ -167,11 +167,13 @@ getq(const struct printer *pp, struct jo
 		 * realloc the maximum size.
 		 */
 		if (++nitems > arraysz) {
-			arraysz *= 2;
-			queue = (struct jobqueue **)realloc((char *)queue,
-			    arraysz * sizeof(struct jobqueue *));
-			if (queue == NULL)
+			queue = (struct jobqueue **)reallocarray((char *)queue,
+			    arraysz, 2 * sizeof(struct jobqueue *));
+			if (queue == NULL) {
+				free(q);
 				goto errdone;
+			}
+			arraysz *= 2;
 		}
 		queue[nitems-1] = q;
 	}