Fix realloc bug (ITS#1410)

diff --git a/libraries/liblber/decode.c b/libraries/liblber/decode.c
index 1e0132d7326cef75ee294dc251ed83e050442c3c..db5a65ade4d2d1b46c78c27b24904d7ff1b41a67 100644 (file)
--- a/libraries/liblber/decode.c
+++ b/libraries/liblber/decode.c
@@ -590,9 +590,17 @@ ber_scanf ( BerElement *ber,
                            tag != LBER_DEFAULT && rc != LBER_DEFAULT;
                            tag = ber_next_element( ber, &len, last ) )
                        {
+                               void *save = *sss;
+
                                *sss = (char **) LBER_REALLOC( *sss,
                                        (j + 2) * sizeof(char *) );
 
+                               if( *sss == NULL ) {
+                                       LBER_MEMFREE( save );
+                                       rc = LBER_DEFAULT;
+                                       goto breakout;
+                               }
+
                                rc = ber_get_stringa( ber, &((*sss)[j]) );
                                j++;
                        }
@@ -608,9 +616,17 @@ ber_scanf ( BerElement *ber,
                            tag != LBER_DEFAULT && rc != LBER_DEFAULT;
                            tag = ber_next_element( ber, &len, last ) )
                        {
+                               void *save = *bv;
+
                                *bv = (struct berval **) LBER_REALLOC( *bv,
                                        (j + 2) * sizeof(struct berval *) );
                
+                               if( *bv == NULL ) {
+                                       LBER_MEMFREE( save );
+                                       rc = LBER_DEFAULT;
+                                       goto breakout;
+                               }
+
                                rc = ber_get_stringal( ber, &((*bv)[j]) );
                                j++;
                        }
@@ -649,6 +665,7 @@ ber_scanf ( BerElement *ber,
                }
        }
 
+breakout:
        va_end( ap );
 
        if ( rc == LBER_DEFAULT ) {