diff options
| author | Rich Megginson <rmeggins@redhat.com> | 2010-06-30 14:15:37 -0600 |
|---|---|---|
| committer | Rich Megginson <rmeggins@redhat.com> | 2010-07-01 15:50:50 -0600 |
| commit | d76bdddeb292b1d71e5d7b1dcdcd985d39025a15 (patch) | |
| tree | 1ab20fd08339144c0b8ef233ac54c4e1a5fda4af | |
| parent | c1a89263495c933673f8b977f6c202f34e65b293 (diff) | |
| download | ds-d76bdddeb292b1d71e5d7b1dcdcd985d39025a15.tar.gz ds-d76bdddeb292b1d71e5d7b1dcdcd985d39025a15.tar.xz ds-d76bdddeb292b1d71e5d7b1dcdcd985d39025a15.zip | |
Bug 609590 - fix coverity Defect Type: Memory - corruptions issues
https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: The code is allocating space for an array of int which is
4 bytes. In this case, since type_name_disposition is int**, doing
*type_name_disposition is still a pointer type rather than the int type. We
have to do **type_name_disposition to get to the int type we want.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
| -rw-r--r-- | ldap/servers/slapd/vattr.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ldap/servers/slapd/vattr.c b/ldap/servers/slapd/vattr.c index 270594d4..b2345827 100644 --- a/ldap/servers/slapd/vattr.c +++ b/ldap/servers/slapd/vattr.c @@ -886,7 +886,7 @@ int slapi_vattr_namespace_values_get_sp(vattr_context *c, /* Complete analysis of type matching */ *type_name_disposition = - (int *)slapi_ch_malloc(sizeof(*type_name_disposition)); + (int *)slapi_ch_malloc(sizeof(**type_name_disposition)); if ( 0 == slapi_attr_type_cmp( type , **actual_type_name, SLAPI_TYPE_CMP_EXACT) ) { **type_name_disposition = @@ -984,7 +984,7 @@ int slapi_vattr_namespace_values_get_sp(vattr_context *c, { *results = (Slapi_ValueSet**)slapi_ch_calloc(1, sizeof(*results) * attr_count); - *type_name_disposition = (int *)slapi_ch_malloc(sizeof(*type_name_disposition) * attr_count); + *type_name_disposition = (int *)slapi_ch_malloc(sizeof(**type_name_disposition) * attr_count); *actual_type_name = (char**)slapi_ch_malloc(sizeof(*actual_type_name) * attr_count); /* For attributes which are in the entry, we just need to get to the Slapi_Attr structure and yank out the slapi_value_set |