From 1c7ad5f7b555388d332cd8df7433a71b958e3fa2 Mon Sep 17 00:00:00 2001
From: deraadt <>
Date: Thu, 29 May 2014 21:42:44 +0000
Subject: I do not have time to describe how bad the realloc() uses in here,
 now being relaced by reallocarray().  you will have to look at the diff.
 there can be no explanations for the extra casts.  as beck says, "Don't go
 towards the light theo!" ok beck tedu

---
 src/lib/libcrypto/lhash/lhash.c         | 6 ++----
 src/lib/libssl/src/crypto/lhash/lhash.c | 6 ++----
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/src/lib/libcrypto/lhash/lhash.c b/src/lib/libcrypto/lhash/lhash.c
index 1e3359cfe0..932391fa1e 100644
--- a/src/lib/libcrypto/lhash/lhash.c
+++ b/src/lib/libcrypto/lhash/lhash.c
@@ -337,8 +337,7 @@ expand(_LHASH *lh)
 
 	if ((lh->p) >= lh->pmax) {
 		j = (int)lh->num_alloc_nodes * 2;
-		n = (LHASH_NODE **)realloc(lh->b,
-		    (int)(sizeof(LHASH_NODE *) * j));
+		n = reallocarray(lh->b, j, sizeof(LHASH_NODE *));
 		if (n == NULL) {
 /*			fputs("realloc error in lhash", stderr); */
 			lh->error++;
@@ -364,8 +363,7 @@ contract(_LHASH *lh)
 	np = lh->b[lh->p + lh->pmax - 1];
 	lh->b[lh->p+lh->pmax - 1] = NULL; /* 24/07-92 - eay - weird but :-( */
 	if (lh->p == 0) {
-		n = (LHASH_NODE **)realloc(lh->b,
-		    (unsigned int)(sizeof(LHASH_NODE *) * lh->pmax));
+		n = reallocarray(lh->b, lh->pmax, sizeof(LHASH_NODE *));
 		if (n == NULL) {
 /*			fputs("realloc error in lhash", stderr); */
 			lh->error++;
diff --git a/src/lib/libssl/src/crypto/lhash/lhash.c b/src/lib/libssl/src/crypto/lhash/lhash.c
index 1e3359cfe0..932391fa1e 100644
--- a/src/lib/libssl/src/crypto/lhash/lhash.c
+++ b/src/lib/libssl/src/crypto/lhash/lhash.c
@@ -337,8 +337,7 @@ expand(_LHASH *lh)
 
 	if ((lh->p) >= lh->pmax) {
 		j = (int)lh->num_alloc_nodes * 2;
-		n = (LHASH_NODE **)realloc(lh->b,
-		    (int)(sizeof(LHASH_NODE *) * j));
+		n = reallocarray(lh->b, j, sizeof(LHASH_NODE *));
 		if (n == NULL) {
 /*			fputs("realloc error in lhash", stderr); */
 			lh->error++;
@@ -364,8 +363,7 @@ contract(_LHASH *lh)
 	np = lh->b[lh->p + lh->pmax - 1];
 	lh->b[lh->p+lh->pmax - 1] = NULL; /* 24/07-92 - eay - weird but :-( */
 	if (lh->p == 0) {
-		n = (LHASH_NODE **)realloc(lh->b,
-		    (unsigned int)(sizeof(LHASH_NODE *) * lh->pmax));
+		n = reallocarray(lh->b, lh->pmax, sizeof(LHASH_NODE *));
 		if (n == NULL) {
 /*			fputs("realloc error in lhash", stderr); */
 			lh->error++;
-- 
cgit v1.2.3-55-g6feb