diff options
| author | Matt Wilson <msw@redhat.com> | 2002-02-13 23:39:19 +0000 |
|---|---|---|
| committer | Matt Wilson <msw@redhat.com> | 2002-02-13 23:39:19 +0000 |
| commit | 7d2669be368eb89e631309ebc683d38f729bbec4 (patch) | |
| tree | bdd3501c2ee13b1fef2df637e6ca44f0215cba73 | |
| parent | 93ce66cdf47f516b59b46876a558f11787bdd754 (diff) | |
| download | anaconda-7d2669be368eb89e631309ebc683d38f729bbec4.tar.gz anaconda-7d2669be368eb89e631309ebc683d38f729bbec4.tar.xz anaconda-7d2669be368eb89e631309ebc683d38f729bbec4.zip | |
fix memory corruption on reallocs of nearly double size (#59484, choosing russian kills installer)
| -rw-r--r-- | iconvmodule/iconvmodule.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/iconvmodule/iconvmodule.c b/iconvmodule/iconvmodule.c index c723511dd..d466a0566 100644 --- a/iconvmodule/iconvmodule.c +++ b/iconvmodule/iconvmodule.c @@ -83,13 +83,14 @@ Iconv_iconv(IconvObject *self, PyObject *args, PyObject* kwargs) /* we ran out of space in outbuf, it needs to be bigger */ char *newbuf; /* a guess at how much more we need */ - size_t curpos, extra = inleft * 2; + size_t cursize, curpos, extra = inleft * 2; /* calculate the current position in the output buffer so we can move outptr to the correct place in the realloced space */ + cursize = outptr - outbuf + outleft; curpos = outptr - outbuf; - newbuf = realloc(outbuf, outptr - outbuf + extra); + newbuf = realloc(outbuf, cursize + extra); if (newbuf == NULL) { free(outbuf); /* XXX set exception */ |