Browse Source

Bug 609590 - fix coverity Defect Type: Memory - corruptions issues

https://bugzilla.redhat.com/show_bug.cgi?id=609590
Resolves: bug 609590
Bug Description: fix coverity Defect Type: Memory - corruptions issues
Reviewed by: nhosoi (Thanks!)
Branch: HEAD
Fix Description: The code is allocating space for an array of int which is
4 bytes.  In this case, since type_name_disposition is int**, doing
*type_name_disposition is still a pointer type rather than the int type.  We
have to do **type_name_disposition to get to the int type we want.
Platforms tested: RHEL5 x86_64
Flag Day: no
Doc impact: no
Rich Megginson 15 years ago
parent
commit
d76bdddeb2
1 changed files with 2 additions and 2 deletions
  1. 2 2
      ldap/servers/slapd/vattr.c

+ 2 - 2
ldap/servers/slapd/vattr.c

@@ -886,7 +886,7 @@ int slapi_vattr_namespace_values_get_sp(vattr_context *c,
 
 					/* Complete analysis of type matching */
 					*type_name_disposition =
-							(int *)slapi_ch_malloc(sizeof(*type_name_disposition));
+							(int *)slapi_ch_malloc(sizeof(**type_name_disposition));
 					if ( 0 == slapi_attr_type_cmp( type , **actual_type_name, SLAPI_TYPE_CMP_EXACT) )
 					{
 						**type_name_disposition =
@@ -984,7 +984,7 @@ int slapi_vattr_namespace_values_get_sp(vattr_context *c,
 		{	
 
 			*results = (Slapi_ValueSet**)slapi_ch_calloc(1, sizeof(*results) * attr_count);
-			*type_name_disposition = (int *)slapi_ch_malloc(sizeof(*type_name_disposition)  * attr_count);
+			*type_name_disposition = (int *)slapi_ch_malloc(sizeof(**type_name_disposition)  * attr_count);
 			*actual_type_name = (char**)slapi_ch_malloc(sizeof(*actual_type_name)  * attr_count);
 
 			/* For attributes which are in the entry, we just need to get to the Slapi_Attr structure and yank out the slapi_value_set