summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Andersen <andersen@codepoet.org>2003-01-24 11:18:29 +0000
committerEric Andersen <andersen@codepoet.org>2003-01-24 11:18:29 +0000
commit79c7ae586df252978ca64862818a7265e2f947af (patch)
treed7eb4edb5f989db1106c8170db49de426f0f7d51
parenta3560dc47b3cf2eef3ebf0e0c9765e11bdf66b6a (diff)
Doh! Fix potential stack corruption caused by dynamic atexit
allocating size incorrectly.... -Erik
-rw-r--r--libc/stdlib/atexit.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/libc/stdlib/atexit.c b/libc/stdlib/atexit.c
index e82f53fe3..8b04e8a04 100644
--- a/libc/stdlib/atexit.c
+++ b/libc/stdlib/atexit.c
@@ -96,12 +96,14 @@ int atexit(aefuncp func)
#ifdef __UCLIBC_DYNAMIC_ATEXIT__
/* If we are out of function table slots, make some more */
if (__exit_slots < __exit_count+1) {
- __exit_function_table=realloc(__exit_function_table, __exit_slots+20);
+ __exit_function_table=realloc(__exit_function_table,
+ (__exit_slots+20)*sizeof(struct exit_function));
if (__exit_function_table==NULL) {
UNLOCK;
__set_errno(ENOMEM);
return -1;
}
+ __exit_slots+=20;
}
#else
if (__exit_count >= __UCLIBC_MAX_ATEXIT) {
@@ -136,12 +138,14 @@ int on_exit(oefuncp func, void *arg)
#ifdef __UCLIBC_DYNAMIC_ATEXIT__
/* If we are out of function table slots, make some more */
if (__exit_slots < __exit_count+1) {
- __exit_function_table=realloc(__exit_function_table, __exit_slots+20);
+ __exit_function_table=realloc(__exit_function_table,
+ (__exit_slots+20)*sizeof(struct exit_function));
if (__exit_function_table==NULL) {
UNLOCK;
__set_errno(ENOMEM);
return -1;
}
+ __exit_slots+=20;
}
#else
if (__exit_count >= __UCLIBC_MAX_ATEXIT) {