T bugfix: include size of 'length' to allocated memory

The way allocation is done (granularity of 64KiB) makes a crash more
difficult to achieve, but if a trace is exactly 64KiB, we miss 4 bytes
in the realloc and then anything may happen.
This commit is contained in:
Cedric Roux
2025-06-02 11:19:23 +02:00
parent bab05384a4
commit 2fa337d853
5 changed files with 10 additions and 10 deletions
+2 -2
View File
@@ -133,8 +133,8 @@ int main(int n, char **v)
int vpos = 0;
if (fullread(socket, &length, 4) == -1) goto read_error;
if (ebuf.omaxsize < length) {
ebuf.omaxsize = (length + 65535) & ~65535;
if (ebuf.omaxsize < length + 4) {
ebuf.omaxsize = (length + 4 + 65535) & ~65535;
ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
}