[Bug 2628] 'mon_getmoremem()' relies on undefined behaviour

bk: 53d7e974DhdcT_XG61P9iwQSGNKVTg

diff --git a/ChangeLog b/ChangeLog
index 07c8248bc2b4de2c155eb186b6d4838c9f9f3147..46be5e43d42cc7b0c34918f6db5417667f707710 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,4 @@
+* [Bug 2628] 'mon_getmoremem()' relies on undefined behaviour
 (4.2.7p453) 2014/07/19 Released by Harlan Stenn <stenn@ntp.org>
 * [Bug 2597] leap file loose ends (follow-up)
   - uniform expiration check messages for config and timer triggered

diff --git a/ntpd/ntp_monitor.c b/ntpd/ntp_monitor.c
index 5f674e1acd7a16d6a87f66cf2effbb6a2025e223..1214e1d661c28b2bc8eb34f9d2e3c5f7b2d35239 100644 (file)
--- a/ntpd/ntp_monitor.c
+++ b/ntpd/ntp_monitor.c
@@ -176,19 +176,20 @@ static void
 mon_getmoremem(void)
 {
        mon_entry *chunk;
-       mon_entry *mon;
        u_int entries;
 
        entries = (0 == mon_mem_increments)
                      ? mru_initalloc
                      : mru_incalloc;
 
-       chunk = emalloc(entries * sizeof(*chunk));
-       for (mon = chunk + entries - 1; mon >= chunk; mon--)
-               mon_free_entry(mon);
+       if (entries) {
+               chunk = emalloc(entries * sizeof(*chunk));
+               mru_alloc += entries;
+               for (chunk += entries; entries; entries--)
+                       mon_free_entry(--chunk);
 
-       mru_alloc += entries;
-       mon_mem_increments++;
+               mon_mem_increments++;
+       }
 }