summaryrefslogtreecommitdiff
path: root/lib/talloc
diff options
context:
space:
mode:
authorKamen Mazdrashki <kamen.mazdrashki@postpath.com>2009-12-05 21:44:15 +0200
committerAndrew Tridgell <tridge@samba.org>2009-12-08 12:39:10 +1100
commit8efabcc8a5dcd83deed8ef8e17826a1d347e6d83 (patch)
tree62fb3ebd2d833ac385d391d0148146d17d15f8e3 /lib/talloc
parent105eb95a57c48e0cb3cf69864e24e958ab2b3c59 (diff)
downloadsamba-8efabcc8a5dcd83deed8ef8e17826a1d347e6d83.tar.gz
samba-8efabcc8a5dcd83deed8ef8e17826a1d347e6d83.tar.bz2
samba-8efabcc8a5dcd83deed8ef8e17826a1d347e6d83.zip
talloc: Fix write behind memory block
If ALWASY_REALLOC is defined and we are to 'shrink' memory block, memcpy() will write outside memory just allocated. Signed-off-by: Andrew Tridgell <tridge@samba.org>
Diffstat (limited to 'lib/talloc')
-rw-r--r--lib/talloc/talloc.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/talloc/talloc.c b/lib/talloc/talloc.c
index 7beda4b0f5..f7b1ac3dbd 100644
--- a/lib/talloc/talloc.c
+++ b/lib/talloc/talloc.c
@@ -1184,7 +1184,7 @@ void *_talloc_realloc(const void *context, void *ptr, size_t size, const char *n
#if ALWAYS_REALLOC
new_ptr = malloc(size + TC_HDR_SIZE);
if (new_ptr) {
- memcpy(new_ptr, tc, tc->size + TC_HDR_SIZE);
+ memcpy(new_ptr, tc, MIN(tc->size, size) + TC_HDR_SIZE);
free(tc);
}
#else