T bugfix: include size of 'length' to allocated memory
The way allocation is done (granularity of 64KiB) makes a crash more difficult to achieve, but if a trace is exactly 64KiB, we miss 4 bytes in the realloc and then anything may happen.
This commit is contained in:
@@ -133,8 +133,8 @@ int main(int n, char **v)
|
||||
int vpos = 0;
|
||||
|
||||
if (fullread(socket, &length, 4) == -1) goto read_error;
|
||||
if (ebuf.omaxsize < length) {
|
||||
ebuf.omaxsize = (length + 65535) & ~65535;
|
||||
if (ebuf.omaxsize < length + 4) {
|
||||
ebuf.omaxsize = (length + 4 + 65535) & ~65535;
|
||||
ebuf.obuf = realloc(ebuf.obuf, ebuf.omaxsize);
|
||||
if (ebuf.obuf == NULL) { printf("out of memory\n"); exit(1); }
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user