diff options
| author | srivijitha dugganapalli <Srivijitha.Dugganapalli@Sun.COM> | 2009-07-31 16:30:06 -0600 |
|---|---|---|
| committer | srivijitha dugganapalli <Srivijitha.Dugganapalli@Sun.COM> | 2009-07-31 16:30:06 -0600 |
| commit | 4f2997b292e45181ce3a682d44c3c14a815d97fd (patch) | |
| tree | 89dc1ba332edf582efd9ff0ad167ab2c07dcc8fd /usr/src | |
| parent | 9bb29364a27d730254cb1aff9c21b6e288695bd9 (diff) | |
| download | illumos-joyent-4f2997b292e45181ce3a682d44c3c14a815d97fd.tar.gz | |
6857836 groupListIoctl()/groupMemberListIoctl() can corrupt memory
Diffstat (limited to 'usr/src')
| -rw-r--r-- | usr/src/lib/libstmf/common/stmf.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/usr/src/lib/libstmf/common/stmf.c b/usr/src/lib/libstmf/common/stmf.c index 7e8fa6c083..d3fdef86ad 100644 --- a/usr/src/lib/libstmf/common/stmf.c +++ b/usr/src/lib/libstmf/common/stmf.c @@ -3125,8 +3125,8 @@ groupListIoctl(stmfGroupList **groupList, int groupType) } /* allocate and copy to caller's buffer */ - *groupList = (stmfGroupList *)calloc(1, sizeof (stmfGroupList) * - stmfIoctl.stmf_obuf_nentries); + *groupList = (stmfGroupList *)calloc(1, sizeof (stmfGroupList) + + sizeof (stmfGroupName) * stmfIoctl.stmf_obuf_nentries); if (*groupList == NULL) { ret = STMF_ERROR_NOMEM; goto done; @@ -3272,7 +3272,8 @@ groupMemberListIoctl(stmfGroupName *groupName, stmfGroupProperties **groupProps, /* allocate and copy to caller's buffer */ *groupProps = (stmfGroupProperties *)calloc(1, - sizeof (stmfGroupProperties) * stmfIoctl.stmf_obuf_nentries); + sizeof (stmfGroupProperties) + + sizeof (stmfDevid) * stmfIoctl.stmf_obuf_nentries); if (*groupProps == NULL) { ret = STMF_ERROR_NOMEM; goto done; |