svn commit: r315164 - head/lib/libpam/modules/pam_exec

[Ngie Cooper]

> On Mar 12, 2017, at 10:41, Pedro F. Giffuni <pfg at FreeBSD.org> wrote:
> 
> Author: pfg
> Date: Sun Mar 12 17:41:51 2017
> New Revision: 315164
> URL: https://svnweb.freebsd.org/changeset/base/315164
> 
> Log:
>  Revert r314780
>  libpam: extra bounds checking through reallocarray(3).
> 
>  It appears to be causing brokenness when reporting PAM_* environment
>  variables. This requires more investigation.
> 
>  Reported by:    lstewart
> 
> Modified:
>  head/lib/libpam/modules/pam_exec/pam_exec.c
> 
> Modified: head/lib/libpam/modules/pam_exec/pam_exec.c
> ==============================================================================
> --- head/lib/libpam/modules/pam_exec/pam_exec.c    Sun Mar 12 16:55:18 2017    (r315163)
> +++ head/lib/libpam/modules/pam_exec/pam_exec.c    Sun Mar 12 17:41:51 2017    (r315164)
> @@ -138,7 +138,7 @@ _pam_exec(pam_handle_t *pamh __unused,
>    nitems = sizeof(env_items) / sizeof(*env_items);
>    /* Count PAM return values put in the environment. */
>    nitems_rv = options->return_prog_exit_status ? PAM_RV_COUNT : 0;
> -    tmp = reallocarray(envlist, envlen + nitems + 1 + nitems_rv + 1,
> +    tmp = realloc(envlist, (envlen + nitems + 1 + nitems_rv + 1) *

Eep. nitems variable use here too (masking nitems macro).
-Ngie