fixed misuse of realloc

if called with size 0, realloc frees the buffer, which may eventually
lead to a double free corruption.
This commit is contained in:
Frank Morgner
2019-01-17 15:04:35 +01:00
parent 3209ef2261
commit c63cc40c34
6 changed files with 44 additions and 32 deletions

View File

@@ -240,12 +240,14 @@ static ssize_t recvFromVICC(struct vicc_ctx *ctx, unsigned char **buffer)
size = ntohs(size);
p = realloc(*buffer, size);
if (p == NULL) {
errno = ENOMEM;
return -1;
if (0 != size) {
p = realloc(*buffer, size);
if (p == NULL) {
errno = ENOMEM;
return -1;
}
*buffer = p;
}
*buffer = p;
/* receive message */
return recvall(ctx->client_sock, *buffer, size);