diff options
| author | Eric Andersen <andersen@codepoet.org> | 2003-01-24 11:18:29 +0000 |
|---|---|---|
| committer | Eric Andersen <andersen@codepoet.org> | 2003-01-24 11:18:29 +0000 |
| commit | 79c7ae586df252978ca64862818a7265e2f947af (patch) | |
| tree | d7eb4edb5f989db1106c8170db49de426f0f7d51 /libc/stdlib | |
| parent | a3560dc47b3cf2eef3ebf0e0c9765e11bdf66b6a (diff) | |
Doh! Fix potential stack corruption caused by dynamic atexit
allocating size incorrectly....
-Erik
Diffstat (limited to 'libc/stdlib')
| -rw-r--r-- | libc/stdlib/atexit.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libc/stdlib/atexit.c b/libc/stdlib/atexit.c index e82f53fe3..8b04e8a04 100644 --- a/libc/stdlib/atexit.c +++ b/libc/stdlib/atexit.c @@ -96,12 +96,14 @@ int atexit(aefuncp func) #ifdef __UCLIBC_DYNAMIC_ATEXIT__ /* If we are out of function table slots, make some more */ if (__exit_slots < __exit_count+1) { - __exit_function_table=realloc(__exit_function_table, __exit_slots+20); + __exit_function_table=realloc(__exit_function_table, + (__exit_slots+20)*sizeof(struct exit_function)); if (__exit_function_table==NULL) { UNLOCK; __set_errno(ENOMEM); return -1; } + __exit_slots+=20; } #else if (__exit_count >= __UCLIBC_MAX_ATEXIT) { @@ -136,12 +138,14 @@ int on_exit(oefuncp func, void *arg) #ifdef __UCLIBC_DYNAMIC_ATEXIT__ /* If we are out of function table slots, make some more */ if (__exit_slots < __exit_count+1) { - __exit_function_table=realloc(__exit_function_table, __exit_slots+20); + __exit_function_table=realloc(__exit_function_table, + (__exit_slots+20)*sizeof(struct exit_function)); if (__exit_function_table==NULL) { UNLOCK; __set_errno(ENOMEM); return -1; } + __exit_slots+=20; } #else if (__exit_count >= __UCLIBC_MAX_ATEXIT) { |