badblocks: Fix crash when lots of -t patterns given

With more than 8 -t patterns given, badblocks will overwrite the
t_patts array boundary due to realloc not taking into account the size
of an int.  Oops.

Addresses-Debian-Bug: 487298

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

diff --git a/misc/badblocks.c b/misc/badblocks.c
index 866144e..df74db4 100644 (file)
--- a/misc/badblocks.c
+++ b/misc/badblocks.c
@@ -995,7 +995,8 @@ int main (int argc, char ** argv)
                        if (t_flag + 1 > t_max) {
                                unsigned int *t_patts_new;
 
-                               t_patts_new = realloc(t_patts, t_max + T_INC);
+                               t_patts_new = realloc(t_patts, sizeof(int) * 
+                                                     (t_max + T_INC));
                                if (!t_patts_new) {
                                        com_err(program_name, ENOMEM,
                                                _("can't allocate memory for "