convert 53 malloc(a*b) to reallocarray(NULL, a, b). that is 53

potential integer overflows easily changed into an allocation return
of NULL, with errno nicely set if need be.  checks for an allocations
returning NULL are commonplace, or if the object is dereferenced
(quite normal) will result in a nice fault which can be detected &
repaired properly.
ok tedu

2 files changed, 3 insertions, 3 deletions

diff --git a/src/lib/libcrypto/pem/pem_lib.c b/src/lib/libcrypto/pem/pem_lib.c
index 58d2bfbee9..945262f019 100644
--- a/src/lib/libcrypto/pem/pem_lib.c
+++ b/src/lib/libcrypto/pem/pem_lib.c
@@ -605,7 +605,7 @@ PEM_write_bio(BIO *bp, const char *name, char *header, unsigned char *data,
                         goto err;
         }
 
-        buf = malloc(PEM_BUFSIZE * 8);
+        buf = reallocarray(NULL, PEM_BUFSIZE, 8);
         if (buf == NULL) {
                 reason = ERR_R_MALLOC_FAILURE;
                 goto err;
diff --git a/src/lib/libcrypto/pem/pem_seal.c b/src/lib/libcrypto/pem/pem_seal.c
index 92b70157cd..a7b9379223 100644
--- a/src/lib/libcrypto/pem/pem_seal.c
+++ b/src/lib/libcrypto/pem/pem_seal.c
@@ -85,7 +85,7 @@ PEM_SealInit(PEM_ENCODE_SEAL_CTX *ctx, EVP_CIPHER *type, EVP_MD *md_type,
                 if (j > max)
                         max = j;
         }
-        s = (char *)malloc(max*2);
+        s = (char *)reallocarray(NULL, max, 2);
         if (s == NULL) {
                 PEMerr(PEM_F_PEM_SEALINIT, ERR_R_MALLOC_FAILURE);
                 goto err;
@@ -159,7 +159,7 @@ PEM_SealFinal(PEM_ENCODE_SEAL_CTX *ctx, unsigned char *sig, int *sigl,
         i = RSA_size(priv->pkey.rsa);
         if (i < 100)
                 i = 100;
-        s = (unsigned char *)malloc(i*2);
+        s = reallocarray(NULL, i, 2);
         if (s == NULL) {
                 PEMerr(PEM_F_PEM_SEALFINAL, ERR_R_MALLOC_FAILURE);
                 goto err;