[src/trunk]: src/lib/libipsec correct unsafe use of realloc().

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/8c524d93f646
branches:  trunk
changeset: 552775:8c524d93f646
user:      itojun <itojun%NetBSD.org@localhost>
date:      Thu Oct 02 19:38:59 2003 +0000

description:
correct unsafe use of realloc().

diffstat:

 lib/libipsec/policy_parse.y |  10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

diffs (33 lines):

diff -r 236fb04fb6a3 -r 8c524d93f646 lib/libipsec/policy_parse.y
--- a/lib/libipsec/policy_parse.y       Thu Oct 02 19:32:41 2003 +0000
+++ b/lib/libipsec/policy_parse.y       Thu Oct 02 19:38:59 2003 +0000
@@ -1,5 +1,5 @@
-/*     $NetBSD: policy_parse.y,v 1.10 2003/07/22 03:32:58 itojun Exp $ */
-/*     $KAME: policy_parse.y,v 1.14 2003/06/27 03:39:20 itojun Exp $   */
+/*     $NetBSD: policy_parse.y,v 1.11 2003/10/02 19:38:59 itojun Exp $ */
+/*     $KAME: policy_parse.y,v 1.15 2003/10/02 19:37:49 itojun Exp $   */
 
 /*
  * Copyright (C) 1995, 1996, 1997, 1998, and 1999 WIDE Project.
@@ -321,17 +321,19 @@
 {
        struct sadb_x_ipsecrequest *p;
        int reqlen;
+       caddr_t n;
 
        reqlen = sizeof(*p)
                + (src ? src->sa_len : 0)
                + (dst ? dst->sa_len : 0);
-       tlen += reqlen;         /* increment to total length */
 
-       pbuf = realloc(pbuf, tlen);
+       n = realloc(pbuf, tlen + reqlen);
        if (pbuf == NULL) {
                __ipsec_errcode = EIPSEC_NO_BUFS;
                return -1;
        }
+       tlen += reqlen;
+       pbuf = n;
        p = (struct sadb_x_ipsecrequest *)&pbuf[offset];
        p->sadb_x_ipsecrequest_len = reqlen;
        p->sadb_x_ipsecrequest_proto = p_protocol;