[PATCH 12/13] Fix realloc for quotas

Bron Gondwana brong at fastmail.fm
Tue Jan 27 23:15:39 EST 2009


From: Bron Gondwana <brong at launde.home.brong.net>

quotadb_legacyquota was allocing bytes rather than sizeof(char *) and
crashing when it got over 100 entries (plus stomping all over the
memory after it randomly when over 25 entries)
---
 lib/cyrusdb_quotalegacy.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/cyrusdb_quotalegacy.c b/lib/cyrusdb_quotalegacy.c
index fbe104e..6067c18 100644
--- a/lib/cyrusdb_quotalegacy.c
+++ b/lib/cyrusdb_quotalegacy.c
@@ -529,7 +529,7 @@ static void scan_qr_dir(char *quota_path, char *prefix, struct qr_path *pathbuf)
 		if (!strncmp(next->d_name, prefix, strlen(prefix))) {
 		    if (pathbuf->count == pathbuf->alloc) {
 			pathbuf->alloc += PATH_ALLOC;
-			pathbuf->path = xrealloc(pathbuf->path, pathbuf->alloc);
+			pathbuf->path = xrealloc(pathbuf->path, pathbuf->alloc * sizeof(char *));
 		    }
 		    pathbuf->path[pathbuf->count] = xmalloc(MAX_QUOTA_PATH+1);
 		    sprintf(pathbuf->path[pathbuf->count++],
@@ -551,7 +551,7 @@ static void scan_qr_dir(char *quota_path, char *prefix, struct qr_path *pathbuf)
 	if (!stat(quota_path, &buf)) {
 	    if (pathbuf->count == pathbuf->alloc) {
 		pathbuf->alloc += PATH_ALLOC;
-		pathbuf->path = xrealloc(pathbuf->path, pathbuf->alloc);
+		pathbuf->path = xrealloc(pathbuf->path, pathbuf->alloc * sizeof(char *));
 	    }
 	    pathbuf->path[pathbuf->count] = xmalloc(MAX_QUOTA_PATH+1);
 	    sprintf(pathbuf->path[pathbuf->count++],
-- 
1.5.6.3



More information about the Cyrus-devel mailing list