1 files changed, 42 insertions, 37 deletions

diff --git a/libXdmcp/Array.c b/libXdmcp/Array.c
index f529781db..6b9b617f7 100644
--- a/libXdmcp/Array.c
+++ b/libXdmcp/Array.c
@@ -44,6 +44,15 @@ xmalloc(size_t size)
 }
 
 /*
+ * This variant of calloc does not return NULL if zero count is passed into.
+ */
+static void *
+xcalloc(size_t n, size_t size)
+{
+    return calloc(n ? n : 1, size);
+}
+
+/*
  * This variant of realloc does not return NULL if zero size is passed into
  */
 static void *
@@ -55,80 +64,73 @@ xrealloc(void *ptr, size_t size)
 int
 XdmcpAllocARRAY8 (ARRAY8Ptr array, int length)
 {
-    CARD8Ptr	newData;
-
     /* length defined in ARRAY8 struct is a CARD16 (not CARD8 like the rest) */
-    if (length > UINT16_MAX)
-	return FALSE;
+    if ((length > UINT16_MAX) || (length < 0))
+        array->data = NULL;
+    else
+        array->data = xmalloc(length * sizeof (CARD8));
 
-    newData = (CARD8Ptr) xmalloc(length * sizeof (CARD8));
-    if (!newData) {
+    if (array->data == NULL) {
 	array->length = 0;
-	array->data = NULL;
 	return FALSE;
     }
     array->length = (CARD16) length;
-    array->data = newData;
     return TRUE;
 }
 
 int
 XdmcpAllocARRAY16 (ARRAY16Ptr array, int length)
 {
-    CARD16Ptr	newData;
-
     /* length defined in ARRAY16 struct is a CARD8 */
-    if (length > UINT8_MAX)
-	return FALSE;
+    if ((length > UINT8_MAX) || (length < 0))
+        array->data = NULL;
+    else
+        array->data = xmalloc(length * sizeof (CARD16));
 
-    newData = (CARD16Ptr) xmalloc(length * sizeof (CARD16));
-    if (!newData) {
+    if (array->data == NULL) {
 	array->length = 0;
-	array->data = NULL;
 	return FALSE;
     }
     array->length = (CARD8) length;
-    array->data = newData;
     return TRUE;
 }
 
 int
 XdmcpAllocARRAY32 (ARRAY32Ptr array, int length)
 {
-    CARD32Ptr	newData;
-
     /* length defined in ARRAY32 struct is a CARD8 */
-    if (length > UINT8_MAX)
-	return FALSE;
+    if ((length > UINT8_MAX) || (length < 0))
+        array->data = NULL;
+    else
+        array->data = xmalloc(length * sizeof (CARD32));
 
-    newData = (CARD32Ptr) xmalloc(length * sizeof (CARD32));
-    if (!newData) {
+    if (array->data == NULL) {
 	array->length = 0;
-	array->data = NULL;
 	return FALSE;
     }
     array->length = (CARD8) length;
-    array->data = newData;
     return TRUE;
 }
 
 int
 XdmcpAllocARRAYofARRAY8 (ARRAYofARRAY8Ptr array, int length)
 {
-    ARRAY8Ptr	newData;
-
     /* length defined in ARRAYofARRAY8 struct is a CARD8 */
-    if (length > UINT8_MAX)
-	return FALSE;
-
-    newData = (ARRAY8Ptr) xmalloc(length * sizeof (ARRAY8));
-    if (!newData) {
+    if ((length > UINT8_MAX) || (length < 0))
+        array->data = NULL;
+    else
+        /*
+         * Use calloc to ensure the pointers are cleared out so we
+         * don't try to free garbage if XdmcpDisposeARRAYofARRAY8()
+         * is called before the caller sets them to valid pointers.
+         */
+        array->data = xcalloc(length, sizeof (ARRAY8));
+
+    if (array->data == NULL) {
 	array->length = 0;
-	array->data = NULL;
 	return FALSE;
     }
     array->length = (CARD8) length;
-    array->data = newData;
     return TRUE;
 }
 
@@ -157,7 +159,7 @@ XdmcpReallocARRAY8 (ARRAY8Ptr array, int length)
     CARD8Ptr	newData;
 
     /* length defined in ARRAY8 struct is a CARD16 (not CARD8 like the rest) */
-    if (length > UINT16_MAX)
+    if ((length > UINT16_MAX) || (length < 0))
 	return FALSE;
 
     newData = (CARD8Ptr) xrealloc(array->data, length * sizeof (CARD8));
@@ -174,12 +176,15 @@ XdmcpReallocARRAYofARRAY8 (ARRAYofARRAY8Ptr array, int length)
     ARRAY8Ptr	newData;
 
     /* length defined in ARRAYofARRAY8 struct is a CARD8 */
-    if (length > UINT8_MAX)
+    if ((length > UINT8_MAX) || (length < 0))
 	return FALSE;
 
     newData = (ARRAY8Ptr) xrealloc(array->data, length * sizeof (ARRAY8));
     if (!newData)
 	return FALSE;
+    if (length > array->length)
+        memset(newData + array->length, 0,
+               (length - array->length) * sizeof (ARRAY8));
     array->length = (CARD8) length;
     array->data = newData;
     return TRUE;
@@ -191,7 +196,7 @@ XdmcpReallocARRAY16 (ARRAY16Ptr array, int length)
     CARD16Ptr	newData;
 
     /* length defined in ARRAY16 struct is a CARD8 */
-    if (length > UINT8_MAX)
+    if ((length > UINT8_MAX) || (length < 0))
 	return FALSE;
     newData = (CARD16Ptr) xrealloc(array->data, length * sizeof (CARD16));
     if (!newData)
@@ -207,7 +212,7 @@ XdmcpReallocARRAY32 (ARRAY32Ptr array, int length)
     CARD32Ptr	newData;
 
     /* length defined in ARRAY32 struct is a CARD8 */
-    if (length > UINT8_MAX)
+    if ((length > UINT8_MAX) || (length < 0))
 	return FALSE;
 
     newData = (CARD32Ptr) xrealloc(array->data, length * sizeof (CARD32));