From 642d45ae22413aa8195b105d051ca8896e782c5d Mon Sep 17 00:00:00 2001
From: deraadt <>
Date: Thu, 29 May 2014 21:07:43 +0000
Subject: convert 53 malloc(a*b) to reallocarray(NULL, a, b).  that is 53
 potential integer overflows easily changed into an allocation return of NULL,
 with errno nicely set if need be.  checks for an allocations returning NULL
 are commonplace, or if the object is dereferenced (quite normal) will result
 in a nice fault which can be detected & repaired properly. ok tedu

---
 src/lib/libcrypto/objects/o_names.c  | 3 ++-
 src/lib/libcrypto/objects/obj_xref.c | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

(limited to 'src/lib/libcrypto/objects')

diff --git a/src/lib/libcrypto/objects/o_names.c b/src/lib/libcrypto/objects/o_names.c
index 196d3ab0a7..169b8ae87d 100644
--- a/src/lib/libcrypto/objects/o_names.c
+++ b/src/lib/libcrypto/objects/o_names.c
@@ -292,7 +292,8 @@ OBJ_NAME_do_all_sorted(int type, void (*fn)(const OBJ_NAME *, void *arg),
 	int n;
 
 	d.type = type;
-	d.names = malloc(lh_OBJ_NAME_num_items(names_lh)*sizeof *d.names);
+	d.names = reallocarray(NULL, lh_OBJ_NAME_num_items(names_lh),
+	    sizeof *d.names);
 	d.n = 0;
 	OBJ_NAME_do_all(type, do_all_sorted_fn, &d);
 
diff --git a/src/lib/libcrypto/objects/obj_xref.c b/src/lib/libcrypto/objects/obj_xref.c
index 25aed74ff1..8e9128efc4 100644
--- a/src/lib/libcrypto/objects/obj_xref.c
+++ b/src/lib/libcrypto/objects/obj_xref.c
@@ -164,7 +164,7 @@ OBJ_add_sigid(int signid, int dig_id, int pkey_id)
 		sigx_app = sk_nid_triple_new(sigx_cmp);
 	if (!sigx_app)
 		return 0;
-	ntr = malloc(sizeof(int) * 3);
+	ntr = reallocarray(NULL, sizeof(int), 3);
 	if (!ntr)
 		return 0;
 	ntr->sign_id = signid;
-- 
cgit v1.2.3-55-g6feb