>Number:         9080
>Category:       bin
>Synopsis:       insufficient malloc error check in systat(1)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Dec 30 01:36:00 1999
>Last-Modified:
>Originator:     Jun-ichiro itojun Hagino
>Organization:
	itojun.org
>Release:        NetBSD-current and all NetBSD 1.4
>Environment:
System: NetBSD turmeric.itojun.org 1.4P NetBSD 1.4P (TURMERIC.v6) #189: Sun Dec 26 21:45:33 PST 1999 itojun@turmeric.itojun.org:/usr/home/itojun/NetBSD/src/sys/arch/i386/compile/TURMERIC.v6 i386


>Description:
	in netcmds.c of usr.bin/systat, there's malloc/realloc used without
	error check.
>How-To-Repeat:
>Fix:
	I'm not sure about the way to exiting the program.

Index: netcmds.c
===================================================================
RCS file: /cvsroot/basesrc/usr.bin/systat/netcmds.c,v
retrieving revision 1.10
diff -c -r1.10 netcmds.c
*** netcmds.c	1999/12/20 04:06:25	1.10
--- netcmds.c	1999/12/30 09:31:02
***************
*** 233,240 ****
  		}
  	if (nports == 0)
  		ports = (struct pitem *)malloc(sizeof (*p));
! 	else
! 		ports = (struct pitem *)realloc(ports, (nports+1)*sizeof (*p));
  	p = &ports[nports++];
  	p->port = port;
  	p->onoff = onoff;
--- 233,248 ----
  		}
  	if (nports == 0)
  		ports = (struct pitem *)malloc(sizeof (*p));
! 	else {
! 		p = (struct pitem *)realloc(ports, (nports+1)*sizeof (*p));
! 		if (p == NULL)
! 			free(ports);
! 		ports = p;
! 	}
! 	if (ports == NULL) {
! 		error("malloc failed");
! 		die(0);
! 	}
  	p = &ports[nports++];
  	p->port = port;
  	p->onoff = onoff;
***************
*** 293,300 ****
  		}
  	if (nhosts == 0)
  		hosts = (struct hitem *)malloc(sizeof (*p));
! 	else
! 		hosts = (struct hitem *)realloc(hosts, (nhosts+1)*sizeof (*p));
  	p = &hosts[nhosts++];
  	p->addr = *in;
  	p->onoff = onoff;
--- 301,316 ----
  		}
  	if (nhosts == 0)
  		hosts = (struct hitem *)malloc(sizeof (*p));
! 	else {
! 		p = (struct hitem *)realloc(hosts, (nhosts+1)*sizeof (*p));
! 		if (p == NULL)
! 			free(hosts);
! 		hosts = p;
! 	}
! 	if (hosts == NULL) {
! 		error("malloc failed");
! 		die(0);
! 	}
  	p = &hosts[nhosts++];
  	p->addr = *in;
  	p->onoff = onoff;
>Audit-Trail:
>Unformatted: