fixed misuse of realloc
if called with size 0, realloc frees the buffer, which may eventually lead to a double free corruption.
This commit is contained in:
@@ -240,12 +240,14 @@ static ssize_t recvFromVICC(struct vicc_ctx *ctx, unsigned char **buffer)
|
||||
|
||||
size = ntohs(size);
|
||||
|
||||
p = realloc(*buffer, size);
|
||||
if (p == NULL) {
|
||||
errno = ENOMEM;
|
||||
return -1;
|
||||
if (0 != size) {
|
||||
p = realloc(*buffer, size);
|
||||
if (p == NULL) {
|
||||
errno = ENOMEM;
|
||||
return -1;
|
||||
}
|
||||
*buffer = p;
|
||||
}
|
||||
*buffer = p;
|
||||
|
||||
/* receive message */
|
||||
return recvall(ctx->client_sock, *buffer, size);
|
||||
|
||||
Reference in New Issue
Block a user