Skip to content

Commit 6713ca4

Browse files
committed
PR/454: Fix memory corruption when the continuation level jumps by more than
20 in a single step.
1 parent b6e8437 commit 6713ca4

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

Diff for: src/funcs.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
#include "file.h"
2828

2929
#ifndef lint
30-
FILE_RCSID("@(#)$File: funcs.c,v 1.80 2015/01/02 21:29:39 christos Exp $")
30+
FILE_RCSID("@(#)$File: funcs.c,v 1.81 2015/05/28 19:26:59 christos Exp $")
3131
#endif /* lint */
3232

3333
#include "magic.h"
@@ -416,7 +416,7 @@ file_check_mem(struct magic_set *ms, unsigned int level)
416416
size_t len;
417417

418418
if (level >= ms->c.len) {
419-
len = (ms->c.len += 20) * sizeof(*ms->c.li);
419+
len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
420420
ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
421421
malloc(len) :
422422
realloc(ms->c.li, len));

0 commit comments

Comments
 (0)