pull up r19065 from trunk

 r19065@cathode-dark-space:  jaltman | 2007-01-18 06:35:33 -0500
 ticket: 5394
 tags: pullup

   	sendto_kdc.c: use of a variable index into a dynamically
 	allocated array to determine the sizeof() an object makes
 	it unclear what type of object is involved.  It also requires
 	a runtime check instead of a compile time replacement.
 	Not to mention that it could lead to the evaluation of an
 	uninitialized variable as was done in this case.  Replace
 	sizeof(array index variable) with sizeof(type).

 	memset() the correct data structure.

ticket: 5394
version_fixed: 1.6.1

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-6@19111 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
index b616578a0bc2a98827aa8b0f1904c66769d3cf7b..764aafe1846321e6219cbd16fb75db06a7c12a11 100644 (file)
--- a/src/lib/krb5/os/sendto_kdc.c
+++ b/src/lib/krb5/os/sendto_kdc.c
@@ -1127,7 +1127,7 @@ krb5int_sendto (krb5_context context, const krb5_data *message,
        return ENOMEM;
     }
 
-    memset(conns, 0, n_conns * sizeof(conns[i]));
+    memset(conns, 0, n_conns * sizeof(struct conn_state));
 
     if (callback_info) {
        callback_data = malloc(n_conns * sizeof(krb5_data));
@@ -1135,7 +1135,7 @@ krb5int_sendto (krb5_context context, const krb5_data *message,
            return ENOMEM;
        }
 
-       memset(conns, 0, n_conns * sizeof(callback_data[i]));
+       memset(callback_data, 0, n_conns * sizeof(krb5_data));
     }
 
     for (i = 0; i < n_conns; i++) {