From: deraadt <deraadt@openbsd.org>
Date: Wed, 7 Oct 2015 18:29:35 +0000 (+0000)
Subject: one simple free, ok mpi
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=9b9fad9c59b097d91770d45cc513dafecb9e03a9;p=openbsd

one simple free, ok mpi
another not so simple free, repaired by mpi
---

diff --git a/sys/net/bsd-comp.c b/sys/net/bsd-comp.c
index 10b5780764b..39eb1f44ae8 100644
--- a/sys/net/bsd-comp.c
+++ b/sys/net/bsd-comp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bsd-comp.c,v 1.11 2015/07/15 22:16:41 deraadt Exp $	*/
+/*	$OpenBSD: bsd-comp.c,v 1.12 2015/10/07 18:29:35 deraadt Exp $	*/
 /*	$NetBSD: bsd-comp.c,v 1.6 1996/10/13 02:10:58 christos Exp $	*/
 
 /* Because this code is derived from the 4.3BSD compress source:
@@ -357,7 +357,7 @@ bsd_alloc(options, opt_len, decomp)
 	db->lens = mallocarray(maxmaxcode + 1, sizeof(db->lens[0]), M_DEVBUF,
 	    M_NOWAIT);
 	if (!db->lens) {
-	    free(db, M_DEVBUF, 0);
+	    free(db, M_DEVBUF, newlen);
 	    return NULL;
 	}
     }
@@ -378,8 +378,8 @@ bsd_free(state)
     struct bsd_db *db = (struct bsd_db *) state;
 
     if (db->lens)
-	free(db->lens, M_DEVBUF, 0);
-    free(db, M_DEVBUF, 0);
+	free(db->lens, M_DEVBUF, (db->maxmaxcode + 1) * sizeof(db->lens[0]));
+    free(db, M_DEVBUF, db->totlen);
 }
 
 static void *