diff options
| author | Kamen Mazdrashki <kamen.mazdrashki@postpath.com> | 2009-12-05 21:44:15 +0200 |
|---|---|---|
| committer | Andrew Tridgell <tridge@samba.org> | 2009-12-08 12:39:10 +1100 |
| commit | 8efabcc8a5dcd83deed8ef8e17826a1d347e6d83 (patch) | |
| tree | 62fb3ebd2d833ac385d391d0148146d17d15f8e3 /lib/talloc | |
| parent | 105eb95a57c48e0cb3cf69864e24e958ab2b3c59 (diff) | |
| download | samba-8efabcc8a5dcd83deed8ef8e17826a1d347e6d83.tar.gz samba-8efabcc8a5dcd83deed8ef8e17826a1d347e6d83.tar.xz samba-8efabcc8a5dcd83deed8ef8e17826a1d347e6d83.zip | |
talloc: Fix write behind memory block
If ALWASY_REALLOC is defined and we are to 'shrink' memory block,
memcpy() will write outside memory just allocated.
Signed-off-by: Andrew Tridgell <tridge@samba.org>
Diffstat (limited to 'lib/talloc')
| -rw-r--r-- | lib/talloc/talloc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/talloc/talloc.c b/lib/talloc/talloc.c index 7beda4b0f5..f7b1ac3dbd 100644 --- a/lib/talloc/talloc.c +++ b/lib/talloc/talloc.c @@ -1184,7 +1184,7 @@ void *_talloc_realloc(const void *context, void *ptr, size_t size, const char *n #if ALWAYS_REALLOC new_ptr = malloc(size + TC_HDR_SIZE); if (new_ptr) { - memcpy(new_ptr, tc, tc->size + TC_HDR_SIZE); + memcpy(new_ptr, tc, MIN(tc->size, size) + TC_HDR_SIZE); free(tc); } #else |