From 79c7ae586df252978ca64862818a7265e2f947af Mon Sep 17 00:00:00 2001 From: Eric Andersen Date: Fri, 24 Jan 2003 11:18:29 +0000 Subject: Doh! Fix potential stack corruption caused by dynamic atexit allocating size incorrectly.... -Erik --- libc/stdlib/atexit.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'libc/stdlib') diff --git a/libc/stdlib/atexit.c b/libc/stdlib/atexit.c index e82f53fe3..8b04e8a04 100644 --- a/libc/stdlib/atexit.c +++ b/libc/stdlib/atexit.c @@ -96,12 +96,14 @@ int atexit(aefuncp func) #ifdef __UCLIBC_DYNAMIC_ATEXIT__ /* If we are out of function table slots, make some more */ if (__exit_slots < __exit_count+1) { - __exit_function_table=realloc(__exit_function_table, __exit_slots+20); + __exit_function_table=realloc(__exit_function_table, + (__exit_slots+20)*sizeof(struct exit_function)); if (__exit_function_table==NULL) { UNLOCK; __set_errno(ENOMEM); return -1; } + __exit_slots+=20; } #else if (__exit_count >= __UCLIBC_MAX_ATEXIT) { @@ -136,12 +138,14 @@ int on_exit(oefuncp func, void *arg) #ifdef __UCLIBC_DYNAMIC_ATEXIT__ /* If we are out of function table slots, make some more */ if (__exit_slots < __exit_count+1) { - __exit_function_table=realloc(__exit_function_table, __exit_slots+20); + __exit_function_table=realloc(__exit_function_table, + (__exit_slots+20)*sizeof(struct exit_function)); if (__exit_function_table==NULL) { UNLOCK; __set_errno(ENOMEM); return -1; } + __exit_slots+=20; } #else if (__exit_count >= __UCLIBC_MAX_ATEXIT) { -- cgit v1.2.3