From: Theodore Ts'o <tytso@mit.edu>
Date: Sun, 6 Jul 2008 22:50:44 +0000 (-0400)
Subject: badblocks: Fix crash when lots of -t patterns given
X-Git-Tag: v1.41-WIP-0707~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=69d813520cf14f5700c38c82b5c147aa3756bbd9;p=thirdparty%2Fe2fsprogs.git

badblocks: Fix crash when lots of -t patterns given

With more than 8 -t patterns given, badblocks will overwrite the
t_patts array boundary due to realloc not taking into account the size
of an int.  Oops.

Addresses-Debian-Bug: 487298

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
---

diff --git a/misc/badblocks.c b/misc/badblocks.c
index 866144e19..df74db45d 100644
--- a/misc/badblocks.c
+++ b/misc/badblocks.c
@@ -995,7 +995,8 @@ int main (int argc, char ** argv)
 			if (t_flag + 1 > t_max) {
 				unsigned int *t_patts_new;
 
-				t_patts_new = realloc(t_patts, t_max + T_INC);
+				t_patts_new = realloc(t_patts, sizeof(int) * 
+						      (t_max + T_INC));
 				if (!t_patts_new) {
 					com_err(program_name, ENOMEM,
 						_("can't allocate memory for "