Fix up potential overflows in size calculations by replacing

[pspp] / src / autorecode.c

diff --git a/src/autorecode.c b/src/autorecode.c
index 619d894e39febd1788099b5de9b2fdc5e526ce57..bf38d922122da5b49566873d9569dc001e433f71 100644 (file)
--- a/src/autorecode.c
+++ b/src/autorecode.c
@@ -164,8 +164,8 @@ cmd_autorecode (void)
     }
 
   arc.src_values_pool = pool_create ();
-  arc.dst_vars = xmalloc (sizeof *arc.dst_vars * arc.var_cnt);
-  arc.src_values = xmalloc (sizeof *arc.src_values * arc.var_cnt);
+  arc.dst_vars = xnmalloc (arc.var_cnt, sizeof *arc.dst_vars);
+  arc.src_values = xnmalloc (arc.var_cnt, sizeof *arc.src_values);
   for (i = 0; i < dst_cnt; i++)
     if (arc.src_vars[i]->type == ALPHA)
       arc.src_values[i] = hsh_create (10, compare_alpha_value,
@@ -231,7 +231,7 @@ recode (const struct autorecode_pgm *arc)
   t->h.proc = autorecode_trns_proc;
   t->h.free = autorecode_trns_free;
   t->owner = pool;
-  t->specs = pool_alloc (t->owner, sizeof *t->specs * arc->var_cnt);
+  t->specs = pool_nalloc (t->owner, arc->var_cnt, sizeof *t->specs);
   t->spec_cnt = arc->var_cnt;
   for (i = 0; i < arc->var_cnt; i++)
     {
@@ -357,7 +357,7 @@ autorecode_proc_func (struct ccase *c, void *arc_)
       vpp = (union value **) hsh_probe (arc->src_values[i], &v);
       if (*vpp == NULL)
         {
-          vp = pool_alloc (arc->src_values_pool, sizeof (union value));
+          vp = pool_alloc (arc->src_values_pool, sizeof *vp);
           if (arc->src_vars[i]->type == NUMERIC)
             vp->f = v.f;
           else