correct multiplication idiom during xreallocarray, and expand appendnum

to size_t to avoid overflow after allocation success
ok guenther doug

diff --git a/usr.bin/sed/extern.h b/usr.bin/sed/extern.h
index 2f11a30..6d2c032 100644 (file)
--- a/usr.bin/sed/extern.h
+++ b/usr.bin/sed/extern.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: extern.h,v 1.8 2015/01/19 15:30:52 krw Exp $ */
+/*     $OpenBSD: extern.h,v 1.9 2015/04/13 05:11:23 deraadt Exp $ */
 /*-
  * Copyright (c) 1992 Diomidis Spinellis.
  * Copyright (c) 1992, 1993
@@ -39,7 +39,7 @@ extern struct s_appends *appends;
 extern regmatch_t *match;
 extern size_t maxnsub;
 extern u_long linenum;
-extern int appendnum;
+extern size_t appendnum;
 extern int lastline;
 extern int Eflag, aflag, eflag, nflag;
 extern char *fname;

diff --git a/usr.bin/sed/process.c b/usr.bin/sed/process.c
index dee3189..12385b8 100644 (file)
--- a/usr.bin/sed/process.c
+++ b/usr.bin/sed/process.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: process.c,v 1.21 2014/12/12 03:22:35 jsg Exp $        */
+/*     $OpenBSD: process.c,v 1.22 2015/04/13 05:11:23 deraadt Exp $    */
 
 /*-
  * Copyright (c) 1992 Diomidis Spinellis.
@@ -67,7 +67,7 @@ static int             substitute(struct s_command *);
 
 struct s_appends *appends;     /* Array of pointers to strings to append. */
 static int appendx;            /* Index into appends array. */
-int appendnum;                 /* Size of appends array. */
+size_t appendnum;              /* Size of appends array. */
 
 static int lastaddr;           /* Set by applies if last address of a range. */
 static int sdone;              /* If any substitutes since last line input. */
@@ -103,8 +103,8 @@ redirect:
                        case 'a':
                                if (appendx >= appendnum) {
                                        appends = xreallocarray(appends,
-                                           appendnum *= 2,
-                                           sizeof(struct s_appends));
+                                           appendnum,
+                                           2 * sizeof(struct s_appends));
                                        appendnum *= 2;
                                }
                                appends[appendx].type = AP_STRING;
@@ -196,10 +196,12 @@ redirect:
                                flush_appends();
                                exit(0);
                        case 'r':
-                               if (appendx >= appendnum)
+                               if (appendx >= appendnum) {
                                        appends = xreallocarray(appends,
-                                           appendnum *= 2,
-                                           sizeof(struct s_appends));
+                                           appendnum,
+                                           2 * sizeof(struct s_appends));
+                                       appendnum *= 2;
+                               }
                                appends[appendx].type = AP_FILE;
                                appends[appendx].s = cp->t;
                                appends[appendx].len = strlen(cp->t);