convert 53 malloc(a*b) to reallocarray(NULL, a, b). that is 53

potential integer overflows easily changed into an allocation return
of NULL, with errno nicely set if need be.  checks for an allocations
returning NULL are commonplace, or if the object is dereferenced
(quite normal) will result in a nice fault which can be detected &
repaired properly.
ok tedu

4 files changed, 10 insertions, 10 deletions

diff --git a/src/lib/libcrypto/bn/bn_ctx.c b/src/lib/libcrypto/bn/bn_ctx.c
index 7407dade50..2368e25183 100644
--- a/src/lib/libcrypto/bn/bn_ctx.c
+++ b/src/lib/libcrypto/bn/bn_ctx.c
@@ -349,8 +349,8 @@ BN_STACK_push(BN_STACK *st, unsigned int idx)
         {
                 unsigned int newsize = (st->size ?
                     (st->size * 3 / 2) : BN_CTX_START_FRAMES);
-                unsigned int *newitems = malloc(newsize *
-                    sizeof(unsigned int));
+                unsigned int *newitems = reallocarray(NULL,
+                    newsize, sizeof(unsigned int));
                 if (!newitems)
                         return 0;
                 if (st->depth)
diff --git a/src/lib/libcrypto/bn/bn_gf2m.c b/src/lib/libcrypto/bn/bn_gf2m.c
index 4000fb8733..4bd50924d3 100644
--- a/src/lib/libcrypto/bn/bn_gf2m.c
+++ b/src/lib/libcrypto/bn/bn_gf2m.c
@@ -547,7 +547,7 @@ BN_GF2m_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p,
         bn_check_top(a);
         bn_check_top(b);
         bn_check_top(p);
-        if ((arr = (int *)malloc(sizeof(int) * max)) == NULL)
+        if ((arr = reallocarray(NULL, sizeof(int), max)) == NULL)
                 goto err;
         ret = BN_GF2m_poly2arr(p, arr, max);
         if (!ret || ret > max) {
@@ -609,7 +609,7 @@ BN_GF2m_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
 
         bn_check_top(a);
         bn_check_top(p);
-        if ((arr = (int *)malloc(sizeof(int) * max)) == NULL)
+        if ((arr = reallocarray(NULL, sizeof(int), max)) == NULL)
                 goto err;
         ret = BN_GF2m_poly2arr(p, arr, max);
         if (!ret || ret > max) {
@@ -1037,7 +1037,7 @@ BN_GF2m_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p,
         bn_check_top(a);
         bn_check_top(b);
         bn_check_top(p);
-        if ((arr = (int *)malloc(sizeof(int) * max)) == NULL)
+        if ((arr = reallocarray(NULL, sizeof(int), max)) == NULL)
                 goto err;
         ret = BN_GF2m_poly2arr(p, arr, max);
         if (!ret || ret > max) {
@@ -1099,7 +1099,7 @@ BN_GF2m_mod_sqrt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
         int *arr = NULL;
         bn_check_top(a);
         bn_check_top(p);
-        if ((arr = (int *)malloc(sizeof(int) * max)) == NULL)
+        if ((arr = reallocarray(NULL, sizeof(int), max)) == NULL)
                 goto err;
         ret = BN_GF2m_poly2arr(p, arr, max);
         if (!ret || ret > max) {
@@ -1234,7 +1234,7 @@ BN_GF2m_mod_solve_quad(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
 
         bn_check_top(a);
         bn_check_top(p);
-        if ((arr = (int *)malloc(sizeof(int) * max)) == NULL)
+        if ((arr = reallocarray(NULL, sizeof(int), max)) == NULL)
                 goto err;
         ret = BN_GF2m_poly2arr(p, arr, max);
         if (!ret || ret > max) {
diff --git a/src/lib/libcrypto/bn/bn_lib.c b/src/lib/libcrypto/bn/bn_lib.c
index a3a96662e8..28489f8181 100644
--- a/src/lib/libcrypto/bn/bn_lib.c
+++ b/src/lib/libcrypto/bn/bn_lib.c
@@ -245,7 +245,7 @@ BN_new(void)
 {
         BIGNUM *ret;
 
-        if ((ret = (BIGNUM *)malloc(sizeof(BIGNUM))) == NULL) {
+        if ((ret = malloc(sizeof(BIGNUM))) == NULL) {
                 BNerr(BN_F_BN_NEW, ERR_R_MALLOC_FAILURE);
                 return (NULL);
         }
@@ -278,7 +278,7 @@ bn_expand_internal(const BIGNUM *b, int words)
                     BN_R_EXPAND_ON_STATIC_BIGNUM_DATA);
                 return (NULL);
         }
-        a = A = (BN_ULONG *)malloc(sizeof(BN_ULONG)*words);
+        a = A = reallocarray(NULL, sizeof(BN_ULONG), words);
         if (A == NULL) {
                 BNerr(BN_F_BN_EXPAND_INTERNAL, ERR_R_MALLOC_FAILURE);
                 return (NULL);
diff --git a/src/lib/libcrypto/bn/bn_print.c b/src/lib/libcrypto/bn/bn_print.c
index 3a0fb25369..ea5fa5c3da 100644
--- a/src/lib/libcrypto/bn/bn_print.c
+++ b/src/lib/libcrypto/bn/bn_print.c
@@ -116,7 +116,7 @@ BN_bn2dec(const BIGNUM *a)
          */
         i = BN_num_bits(a) * 3;
         num = (i / 10 + i / 1000 + 1) + 1;
-        bn_data = (BN_ULONG *)malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));
+        bn_data = reallocarray(NULL, num / BN_DEC_NUM + 1, sizeof(BN_ULONG));
         buf = (char *)malloc(num + 3);
         if ((buf == NULL) || (bn_data == NULL)) {
                 BNerr(BN_F_BN_BN2DEC, ERR_R_MALLOC_FAILURE);