Subject: bin/9080: insufficient malloc error check in systat(1)
To: None <gnats-bugs@gnats.netbsd.org>
From: None <itojun@itojun.org>
List: netbsd-bugs
Date: 12/30/1999 01:36:39
>Number: 9080
>Category: bin
>Synopsis: insufficient malloc error check in systat(1)
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: bin-bug-people (Utility Bug People)
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Thu Dec 30 01:36:00 1999
>Last-Modified:
>Originator: Jun-ichiro itojun Hagino
>Organization:
itojun.org
>Release: NetBSD-current and all NetBSD 1.4
>Environment:
System: NetBSD turmeric.itojun.org 1.4P NetBSD 1.4P (TURMERIC.v6) #189: Sun Dec 26 21:45:33 PST 1999 itojun@turmeric.itojun.org:/usr/home/itojun/NetBSD/src/sys/arch/i386/compile/TURMERIC.v6 i386
>Description:
in netcmds.c of usr.bin/systat, there's malloc/realloc used without
error check.
>How-To-Repeat:
>Fix:
I'm not sure about the way to exiting the program.
Index: netcmds.c
===================================================================
RCS file: /cvsroot/basesrc/usr.bin/systat/netcmds.c,v
retrieving revision 1.10
diff -c -r1.10 netcmds.c
*** netcmds.c 1999/12/20 04:06:25 1.10
--- netcmds.c 1999/12/30 09:31:02
***************
*** 233,240 ****
}
if (nports == 0)
ports = (struct pitem *)malloc(sizeof (*p));
! else
! ports = (struct pitem *)realloc(ports, (nports+1)*sizeof (*p));
p = &ports[nports++];
p->port = port;
p->onoff = onoff;
--- 233,248 ----
}
if (nports == 0)
ports = (struct pitem *)malloc(sizeof (*p));
! else {
! p = (struct pitem *)realloc(ports, (nports+1)*sizeof (*p));
! if (p == NULL)
! free(ports);
! ports = p;
! }
! if (ports == NULL) {
! error("malloc failed");
! die(0);
! }
p = &ports[nports++];
p->port = port;
p->onoff = onoff;
***************
*** 293,300 ****
}
if (nhosts == 0)
hosts = (struct hitem *)malloc(sizeof (*p));
! else
! hosts = (struct hitem *)realloc(hosts, (nhosts+1)*sizeof (*p));
p = &hosts[nhosts++];
p->addr = *in;
p->onoff = onoff;
--- 301,316 ----
}
if (nhosts == 0)
hosts = (struct hitem *)malloc(sizeof (*p));
! else {
! p = (struct hitem *)realloc(hosts, (nhosts+1)*sizeof (*p));
! if (p == NULL)
! free(hosts);
! hosts = p;
! }
! if (hosts == NULL) {
! error("malloc failed");
! die(0);
! }
p = &hosts[nhosts++];
p->addr = *in;
p->onoff = onoff;
>Audit-Trail:
>Unformatted: