svn commit: r315659 - stable/11/usr.sbin/lpr/common_source

[Pedro F. Giffuni]

Author: pfg
Date: Tue Mar 21 03:42:28 2017
New Revision: 315659
URL: https://svnweb.freebsd.org/changeset/base/315659

Log:
  MFC r314877:
  lpr(1): small bounds check with reallocarray(3).
  
  While here plug a memory leak upon error and postpose the multiplication
  until after reallocation has succeded.
  
  Hinted partially by:	OpenBSD
  Reviewed by:		gad

Modified:
  stable/11/usr.sbin/lpr/common_source/common.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/usr.sbin/lpr/common_source/common.c
==============================================================================
--- stable/11/usr.sbin/lpr/common_source/common.c	Tue Mar 21 01:24:56 2017	(r315658)
+++ stable/11/usr.sbin/lpr/common_source/common.c	Tue Mar 21 03:42:28 2017	(r315659)
@@ -167,11 +167,13 @@ getq(const struct printer *pp, struct jo
 		 * realloc the maximum size.
 		 */
 		if (++nitems > arraysz) {
-			arraysz *= 2;
-			queue = (struct jobqueue **)realloc((char *)queue,
-			    arraysz * sizeof(struct jobqueue *));
-			if (queue == NULL)
+			queue = (struct jobqueue **)reallocarray((char *)queue,
+			    arraysz, 2 * sizeof(struct jobqueue *));
+			if (queue == NULL) {
+				free(q);
 				goto errdone;
+			}
+			arraysz *= 2;
 		}
 		queue[nitems-1] = q;
 	}