From: Jeffrey Altman <jaltman@secure-endpoints.com>
Date: Thu, 18 Jan 2007 11:35:33 +0000 (+0000)
Subject:   	sendto_kdc.c: use of a variable index into a dynamically
X-Git-Tag: krb5-1.7-alpha1~1357
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=d443eb86fdde098790c7590c3338591003f639d6;p=krb5.git

  	sendto_kdc.c: use of a variable index into a dynamically
	allocated array to determine the sizeof() an object makes
	it unclear what type of object is involved.  It also requires
	a runtime check instead of a compile time replacement.
	Not to mention that it could lead to the evaluation of an
	uninitialized variable as was done in this case.  Replace
	sizeof(array index variable) with sizeof(type).

	memset() the correct data structure.

ticket: 5394
tags: pullup

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19065 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
index b616578a0..764aafe18 100644
--- a/src/lib/krb5/os/sendto_kdc.c
+++ b/src/lib/krb5/os/sendto_kdc.c
@@ -1127,7 +1127,7 @@ krb5int_sendto (krb5_context context, const krb5_data *message,
 	return ENOMEM;
     }
 
-    memset(conns, 0, n_conns * sizeof(conns[i]));
+    memset(conns, 0, n_conns * sizeof(struct conn_state));
 
     if (callback_info) {
 	callback_data = malloc(n_conns * sizeof(krb5_data));
@@ -1135,7 +1135,7 @@ krb5int_sendto (krb5_context context, const krb5_data *message,
 	    return ENOMEM;
 	}
 
-	memset(conns, 0, n_conns * sizeof(callback_data[i]));
+	memset(callback_data, 0, n_conns * sizeof(krb5_data));
     }
 
     for (i = 0; i < n_conns; i++) {