(ADD_RANGE_PAIR): Use x2nrealloc rather than xrealloc,

to avoid potential overflow in pointer arithmetic.
(set_fields): Use not `1', but rather `sizeof *printable_field' as
second argument to xcalloc.

1 files changed, 6 insertions, 11 deletions

diff --git a/src/cut.c b/src/cut.c
index 9ed4f866a..0979dc348 100644
--- a/src/cut.c
+++ b/src/cut.c
@@ -58,8 +58,7 @@
     {									\
       if (n_rp >= n_rp_allocated)					\
 	{								\
-	  n_rp_allocated *= 2;						\
-	  (rp) = xrealloc (rp, n_rp_allocated * sizeof (*(rp)));	\
+	  (rp) = x2nrealloc (rp, &n_rp_allocated, sizeof (*(rp)));	\
 	}								\
       rp[n_rp].lo = (low);						\
       rp[n_rp].hi = (high);						\
@@ -311,16 +310,12 @@ set_fields (const char *fieldstr)
   int field_found = 0;		/* Non-zero if at least one field spec
 				   has been processed.  */
 
-  struct range_pair *rp;
-  unsigned int n_rp;
-  unsigned int n_rp_allocated;
+  struct range_pair *rp = NULL;
+  unsigned int n_rp = 0;
+  unsigned int n_rp_allocated = 0;
   unsigned int i;
   bool in_digits = false;
 
-  n_rp = 0;
-  n_rp_allocated = 16;
-  rp = xmalloc (n_rp_allocated * sizeof (*rp));
-
   /* Collect and store in RP the range end points.
      It also sets EOL_RANGE_START if appropriate.  */
 
@@ -463,8 +458,8 @@ set_fields (const char *fieldstr)
      the field numbers corresponding to all finite ranges
      (i.e. `2-6' or `-4', but not `5-') in FIELDSTR.  */
 
-  printable_field = xcalloc (((max_range_endpoint / CHAR_BIT + 1)
-			      * sizeof (*printable_field)), 1);
+  printable_field = xcalloc (max_range_endpoint / CHAR_BIT + 1,
+			     sizeof *printable_field);
 
   /* Set the array entries corresponding to integers in the ranges of RP.  */
   for (i = 0; i < n_rp; i++)