Index: bin/ed/glbl.c =================================================================== --- bin/ed/glbl.c +++ bin/ed/glbl.c @@ -152,8 +152,8 @@ #if defined(sun) || defined(NO_REALLOC_NULL) if (active_list != NULL) { #endif - if ((ts = (line_t **) realloc(active_list, - (ti += MINBUFSZ) * sizeof(line_t *))) == NULL) { + if ((ts = reallocarray(active_list, ti += MINBUFSZ, + sizeof(line_t *))) == NULL) { fprintf(stderr, "%s\n", strerror(errno)); errmsg = "out of memory"; SPL0(); Index: bin/ed/undo.c =================================================================== --- bin/ed/undo.c +++ bin/ed/undo.c @@ -52,7 +52,7 @@ #endif t = ustack; if (u_p < usize || - (t = (undo_t *) realloc(ustack, (usize += USIZE) * sizeof(undo_t))) != NULL) { + (t = reallocarray(ustack, usize += USIZE, sizeof(undo_t))) != NULL) { ustack = t; ustack[u_p].type = type; ustack[u_p].t = get_addressed_line_node(to); Index: bin/ls/print.c =================================================================== --- bin/ls/print.c +++ bin/ls/print.c @@ -383,8 +383,8 @@ * of pointers. */ if (dp->entries > lastentries) { - if ((narray = - realloc(array, dp->entries * sizeof(FTSENT *))) == NULL) { + if ((narray = reallocarray(array, dp->entries, + sizeof(FTSENT *))) == NULL) { printscol(dp); return; } Index: bin/pax/options.c =================================================================== --- bin/pax/options.c +++ bin/pax/options.c @@ -750,8 +750,8 @@ case 'I': if (++nincfiles > incfiles_max) { incfiles_max = nincfiles + 3; - incfiles = realloc(incfiles, - sizeof(*incfiles) * incfiles_max); + incfiles = reallocarray(incfiles, incfiles_max, + sizeof(*incfiles)); if (incfiles == NULL) { paxwarn(0, "Unable to allocate space " "for option list"); Index: bin/ps/ps.c =================================================================== --- bin/ps/ps.c +++ bin/ps/ps.c @@ -1118,7 +1118,7 @@ int newmax; newmax = (inf->maxcount + 1) << 1; - newlist = realloc(inf->l.ptr, newmax * inf->elemsize); + newlist = reallocarray(inf->l.ptr, newmax, inf->elemsize); if (newlist == NULL) { free(inf->l.ptr); xo_errx(1, "realloc to %d %ss failed", newmax, inf->lname); Index: cddl/contrib/opensolaris/lib/libdtrace/common/dt_open.c =================================================================== --- cddl/contrib/opensolaris/lib/libdtrace/common/dt_open.c +++ cddl/contrib/opensolaris/lib/libdtrace/common/dt_open.c @@ -865,7 +865,8 @@ if (dfp->df_ents == dfp->df_size) { uint_t size = dfp->df_size ? dfp->df_size * 2 : 16; - int *fds = realloc(dfp->df_fds, size * sizeof (int)); + int *fds = reallocarray(dfp->df_fds, size, + sizeof (int)); if (fds == NULL) break; /* skip the rest of this directory */ @@ -952,7 +953,8 @@ while ((p1 = strsep(&p," ")) != NULL) { if (dfp->df_ents == dfp->df_size) { uint_t size = dfp->df_size ? dfp->df_size * 2 : 16; - int *fds = realloc(dfp->df_fds, size * sizeof (int)); + int *fds = reallocarray(dfp->df_fds, size, + sizeof (int)); if (fds == NULL) break; Index: cddl/contrib/opensolaris/lib/libdtrace/common/dt_strtab.c =================================================================== --- cddl/contrib/opensolaris/lib/libdtrace/common/dt_strtab.c +++ cddl/contrib/opensolaris/lib/libdtrace/common/dt_strtab.c @@ -47,7 +47,7 @@ if ((ptr = malloc(sp->str_bufsz)) == NULL) return (-1); - bufs = realloc(sp->str_bufs, (sp->str_nbufs + 1) * sizeof (char *)); + bufs = reallocarray(sp->str_bufs, sp->str_nbufs + 1, sizeof (char *)); if (bufs == NULL) { free(ptr); Index: cddl/contrib/opensolaris/lib/libdtrace/common/dt_subr.c =================================================================== --- cddl/contrib/opensolaris/lib/libdtrace/common/dt_subr.c +++ cddl/contrib/opensolaris/lib/libdtrace/common/dt_subr.c @@ -430,7 +430,8 @@ if (dtp->dt_cpp_argc == dtp->dt_cpp_args) { int olds = dtp->dt_cpp_args; int news = olds * 2; - char **argv = realloc(dtp->dt_cpp_argv, sizeof (char *) * news); + char **argv = reallocarray(dtp->dt_cpp_argv, news, + sizeof(char *)); if (argv == NULL) return (NULL); Index: cddl/contrib/opensolaris/lib/libzfs/common/libzfs_pool.c =================================================================== --- cddl/contrib/opensolaris/lib/libzfs/common/libzfs_pool.c +++ cddl/contrib/opensolaris/lib/libzfs/common/libzfs_pool.c @@ -3719,8 +3719,8 @@ /* add record to nvlist array */ (*numrecords)++; if (ISP2(*numrecords + 1)) { - *records = realloc(*records, - *numrecords * 2 * sizeof (nvlist_t *)); + *records = reallocarray(*records, + *numrecords * 2, sizeof (nvlist_t *)); } (*records)[*numrecords - 1] = nv; } Index: lib/libc/gen/glob.c =================================================================== --- lib/libc/gen/glob.c +++ lib/libc/gen/glob.c @@ -850,7 +850,7 @@ const char *origpat) { char **pathv; - size_t i, newsize, len; + size_t i, newn, len; char *copy; const Char *p; @@ -860,9 +860,9 @@ return (GLOB_NOSPACE); } - newsize = sizeof(*pathv) * (2 + pglob->gl_pathc + pglob->gl_offs); - /* realloc(NULL, newsize) is equivalent to malloc(newsize). */ - pathv = realloc((void *)pglob->gl_pathv, newsize); + newn = 2 + pglob->gl_pathc + pglob->gl_offs; + /* reallocarray(NULL, newn, size) is equivalent to malloc(newn*size). * + pathv = reallocarray((void *)pglob->gl_pathv, newn, sizeof(*pathv)); if (pathv == NULL) return (GLOB_NOSPACE); Index: lib/libc/gen/scandir.c =================================================================== --- lib/libc/gen/scandir.c +++ lib/libc/gen/scandir.c @@ -115,8 +115,8 @@ if (nitems >= arraysz) { struct dirent **names2; - names2 = (struct dirent **)realloc((char *)names, - (arraysz * 2) * sizeof(struct dirent *)); + names2 = (struct dirent **)reallocarray((char *)names, + arraysz, 2 * sizeof(struct dirent *)); if (names2 == NULL) { free(p); goto fail; Index: lib/libc/gen/setmode.c =================================================================== --- lib/libc/gen/setmode.c +++ lib/libc/gen/setmode.c @@ -155,7 +155,7 @@ if (set >= endset) { \ BITCMD *newset; \ setlen += SET_LEN_INCR; \ - newset = realloc(saveset, sizeof(BITCMD) * setlen); \ + newset = reallocarray(saveset, setlen, sizeof(BITCMD)); \ if (newset == NULL) \ goto out; \ set = newset + (set - saveset); \ Index: lib/libc/gen/wordexp.c =================================================================== --- lib/libc/gen/wordexp.c +++ lib/libc/gen/wordexp.c @@ -234,8 +234,8 @@ vofs += we->we_offs; we->we_wordc += nwords; we->we_nbytes += nbytes; - if ((nwv = realloc(we->we_wordv, (we->we_wordc + 1 + - (flags & WRDE_DOOFFS ? we->we_offs : 0)) * + if ((nwv = reallocarray(we->we_wordv, (we->we_wordc + 1 + + (flags & WRDE_DOOFFS ? we->we_offs : 0)), sizeof(char *))) == NULL) { error = WRDE_NOSPACE; goto cleanup; Index: lib/libc/iconv/citrus_esdb.c =================================================================== --- lib/libc/iconv/citrus_esdb.c +++ lib/libc/iconv/citrus_esdb.c @@ -349,7 +349,7 @@ ret = 0; /* XXX: why reallocing the list space posteriorly? shouldn't be done earlier? */ - q = realloc(list, num * sizeof(char *)); + q = reallocarray(list, num, sizeof(char *)); if (!q) { ret = ENOMEM; goto quit3; Index: lib/libc/net/nsdispatch.c =================================================================== --- lib/libc/net/nsdispatch.c +++ lib/libc/net/nsdispatch.c @@ -213,7 +213,7 @@ void *p; if ((*count % ELEMSPERCHUNK) == 0) { - p = realloc(vec, (*count + ELEMSPERCHUNK) * esize); + p = reallocarray(vec, *count + ELEMSPERCHUNK, esize); if (p == NULL) { nss_log_simple(LOG_ERR, "memory allocation failure"); return (vec); Index: lib/libc/regex/regcomp.c =================================================================== --- lib/libc/regex/regcomp.c +++ lib/libc/regex/regcomp.c @@ -1143,7 +1143,7 @@ { cset *cs, *ncs; - ncs = realloc(p->g->sets, (p->g->ncsets + 1) * sizeof(*ncs)); + ncs = reallocarray(p->g->sets, p->g->ncsets + 1, sizeof(*ncs)); if (ncs == NULL) { SETERROR(REG_ESPACE); return (NULL); @@ -1206,7 +1206,7 @@ if (ch < NC) cs->bmp[ch >> 3] |= 1 << (ch & 7); else { - newwides = realloc(cs->wides, (cs->nwides + 1) * + newwides = reallocarray(cs->wides, cs->nwides + 1, sizeof(*cs->wides)); if (newwides == NULL) { SETERROR(REG_ESPACE); @@ -1235,7 +1235,7 @@ CHadd(p, cs, min); if (min >= max) return; - newranges = realloc(cs->ranges, (cs->nranges + 1) * + newranges = reallocarray(cs->ranges, cs->nranges + 1, sizeof(*cs->ranges)); if (newranges == NULL) { SETERROR(REG_ESPACE); @@ -1259,7 +1259,7 @@ for (i = 0; i < NC; i++) if (iswctype(i, wct)) CHadd(p, cs, i); - newtypes = realloc(cs->types, (cs->ntypes + 1) * + newtypes = reallocarray(cs->types, cs->ntypes + 1, sizeof(*cs->types)); if (newtypes == NULL) { SETERROR(REG_ESPACE); @@ -1382,7 +1382,7 @@ if (p->ssize >= size) return 1; - sp = (sop *)realloc(p->strip, size*sizeof(sop)); + sp = (sop *)reallocarray(p->strip, size, sizeof(sop)); if (sp == NULL) { SETERROR(REG_ESPACE); return 0; @@ -1400,7 +1400,7 @@ stripsnug(struct parse *p, struct re_guts *g) { g->nstates = p->slen; - g->strip = (sop *)realloc((char *)p->strip, p->slen * sizeof(sop)); + g->strip = (sop *)reallocarray((char *)p->strip, p->slen, sizeof(sop)); if (g->strip == NULL) { SETERROR(REG_ESPACE); g->strip = p->strip; Index: lib/libc/rpc/getnetconfig.c =================================================================== --- lib/libc/rpc/getnetconfig.c +++ lib/libc/rpc/getnetconfig.c @@ -630,8 +630,8 @@ ncp->nc_lookups = NULL; ncp->nc_nlookups = 0; while ((cp = tokenp) != NULL) { - if ((nc_lookups = realloc(ncp->nc_lookups, - (ncp->nc_nlookups + 1) * sizeof *ncp->nc_lookups)) == NULL) { + if ((nc_lookups = reallocarray(ncp->nc_lookups, + ncp->nc_nlookups + 1, sizeof *ncp->nc_lookups)) == NULL) { free(ncp->nc_lookups); ncp->nc_lookups = NULL; return (-1); Index: lib/libc/stdio/open_wmemstream.c =================================================================== --- lib/libc/stdio/open_wmemstream.c +++ lib/libc/stdio/open_wmemstream.c @@ -63,7 +63,7 @@ else newsize = newoff; if (newsize > ms->len) { - buf = realloc(*ms->bufp, (newsize + 1) * sizeof(wchar_t)); + buf = reallocarray(*ms->bufp, newsize + 1, sizeof(wchar_t)); if (buf != NULL) { #ifdef DEBUG fprintf(stderr, "WMS: %p growing from %zd to %zd\n", Index: lib/libc/stdio/printf-pos.c =================================================================== --- lib/libc/stdio/printf-pos.c +++ lib/libc/stdio/printf-pos.c @@ -654,7 +654,7 @@ return (-1); bcopy(oldtable, newtable, oldsize * sizeof(enum typeid)); } else { - newtable = realloc(oldtable, newsize * sizeof(enum typeid)); + newtable = reallocarray(oldtable, newsize, sizeof(enum typeid)); if (newtable == NULL) return (-1); } Index: lib/libc/stdio/ungetc.c =================================================================== --- lib/libc/stdio/ungetc.c +++ lib/libc/stdio/ungetc.c @@ -73,14 +73,14 @@ return (0); } i = fp->_ub._size; - p = realloc(fp->_ub._base, (size_t)(i << 1)); + p = reallocarray(fp->_ub._base, i, 2); if (p == NULL) return (EOF); /* no overlap (hence can use memcpy) because we doubled the size */ (void)memcpy((void *)(p + i), (void *)p, (size_t)i); fp->_p = p + i; fp->_ub._base = p; - fp->_ub._size = i << 1; + fp->_ub._size = i * 2; return (0); } Index: lib/libc/stdlib/getenv.c =================================================================== --- lib/libc/stdlib/getenv.c +++ lib/libc/stdlib/getenv.c @@ -272,8 +272,8 @@ /* Resize environ. */ if (newEnvironSize > environSize) { tmpEnvironSize = newEnvironSize * 2; - tmpEnviron = realloc(intEnviron, sizeof (*intEnviron) * - (tmpEnvironSize + 1)); + tmpEnviron = reallocarray(intEnviron, tmpEnvironSize + 1, + sizeof (*intEnviron)); if (tmpEnviron == NULL) return (-1); environSize = tmpEnvironSize; @@ -306,8 +306,8 @@ envVarsTotal++; if (envVarsTotal > envVarsSize) { newEnvVarsSize = envVarsTotal * 2; - tmpEnvVars = realloc(envVars, sizeof (*envVars) * - newEnvVarsSize); + tmpEnvVars = reallocarray(envVars, newEnvVarsSize, + sizeof (*envVars)); if (tmpEnvVars == NULL) { envVarsTotal--; return (false); Index: lib/libgssapi/gss_buffer_set.c =================================================================== --- lib/libgssapi/gss_buffer_set.c +++ lib/libgssapi/gss_buffer_set.c @@ -76,8 +76,8 @@ } set = *buffer_set; - set->elements = realloc(set->elements, - (set->count + 1) * sizeof(set->elements[0])); + set->elements = reallocarray(set->elements, + (set->count + 1), sizeof(set->elements[0])); if (set->elements == NULL) { *minor_status = ENOMEM; return (GSS_S_FAILURE); Index: lib/libiconv_modules/ISO2022/citrus_iso2022.c =================================================================== --- lib/libiconv_modules/ISO2022/citrus_iso2022.c +++ lib/libiconv_modules/ISO2022/citrus_iso2022.c @@ -259,8 +259,8 @@ if (!ei->recommend[i]) ei->recommend[i] = malloc(sizeof(_ISO2022Charset)); else { - p = realloc(ei->recommend[i], - sizeof(_ISO2022Charset) * (ei->recommendsize[i] + 1)); + p = reallocarray(ei->recommend[i], ei->recommendsize[i] + 1, + sizeof(_ISO2022Charset)); if (!p) return (_PARSEFAIL); ei->recommend[i] = p; Index: lib/libjail/jail.c =================================================================== --- lib/libjail/jail.c +++ lib/libjail/jail.c @@ -250,7 +250,7 @@ /* Add the parameter to the list */ if (njp >= nlist) { nlist *= 2; - tjp = realloc(jp, nlist * sizeof(*jp)); + tjp = reallocarray(jp, nlist, sizeof(*jp)); if (tjp == NULL) goto error; jp = tjp; @@ -259,7 +259,7 @@ goto error; mib1[1] = 2; } - jp = realloc(jp, njp * sizeof(*jp)); + jp = reallocarray(jp, njp, sizeof(*jp)); *jpp = jp; return (njp); Index: lib/libkvm/kvm_proc.c =================================================================== --- lib/libkvm/kvm_proc.c +++ lib/libkvm/kvm_proc.c @@ -721,7 +721,7 @@ p += strlen(p) + 1; if (i >= argc) { argc += argc; - nbufp = realloc(bufp, sizeof(char *) * argc); + nbufp = reallocarray(bufp, argc, sizeof(char *)); if (nbufp == NULL) return (NULL); bufp = nbufp; Index: lib/libprocstat/libprocstat.c =================================================================== --- lib/libprocstat/libprocstat.c +++ lib/libprocstat/libprocstat.c @@ -1783,7 +1783,7 @@ continue; /* Grow argv. */ argc += argc; - argv = realloc(argv, sizeof(char *) * argc); + argv = reallocarray(argv, argc, sizeof(char *)); if (argv == NULL) { warn("malloc(%zu)", sizeof(char *) * argc); return (NULL); Index: lib/libthread_db/libpthread_db.c =================================================================== --- lib/libthread_db/libpthread_db.c +++ lib/libthread_db/libpthread_db.c @@ -94,8 +94,8 @@ ta->map_len = 20; first = 1; } else { - new = realloc(ta->map, - sizeof(struct pt_map) * ta->map_len * 2); + new = reallocarray(ta->map, ta->map_len * 2, + sizeof(struct pt_map)); if (new == NULL) return (-1); memset(new + ta->map_len, '\0', sizeof(struct pt_map) * Index: lib/libusbhid/usage.c =================================================================== --- lib/libusbhid/usage.c +++ lib/libusbhid/usage.c @@ -113,8 +113,8 @@ if (curpage->pagesize >= curpage->pagesizemax) { curpage->pagesizemax += 10; curpage->page_contents = - realloc(curpage->page_contents, - curpage->pagesizemax * + reallocarray(curpage->page_contents, + curpage->pagesizemax, sizeof (struct usage_in_page)); if (!curpage->page_contents) err(1, "realloc"); Index: lib/libutil/gr_util.c =================================================================== --- lib/libutil/gr_util.c +++ lib/libutil/gr_util.c @@ -205,7 +205,7 @@ if (eof) break; while ((size_t)(q - p) >= size) { - if ((tmp = realloc(buf, size * 2)) == NULL) { + if ((tmp = reallocarray(buf, 2, size)) == NULL) { warnx("group line too long"); goto err; } Index: lib/libutil/login_cap.c =================================================================== --- lib/libutil/login_cap.c +++ lib/libutil/login_cap.c @@ -86,7 +86,7 @@ if (sz <= internal_arraysz) p = internal_array; - else if ((p = realloc(internal_array, sz * sizeof(char*))) != NULL) { + else if ((p = reallocarray(internal_array, sz, sizeof(char*))) != NULL) { internal_arraysz = sz; internal_array = p; } Index: lib/libutil/login_ok.c =================================================================== --- lib/libutil/login_ok.c +++ lib/libutil/login_ok.c @@ -101,7 +101,8 @@ ; if (*ltno >= j) lt = *ltptr; - else if ((lt = realloc(*ltptr, j * sizeof(struct login_time))) != NULL) { + else if ((lt = reallocarray(*ltptr, j, sizeof(struct login_time))) != + NULL) { *ltno = j; *ltptr = lt; } Index: lib/libutil/pw_util.c =================================================================== --- lib/libutil/pw_util.c +++ lib/libutil/pw_util.c @@ -468,7 +468,7 @@ if (eof) break; while ((size_t)(q - p) >= size) { - if ((tmp = realloc(buf, size * 2)) == NULL) { + if ((tmp = reallocarray(buf, 2, size)) == NULL) { warnx("passwd line too long"); goto err; } Index: sbin/atm/atmconfig/main.c =================================================================== --- sbin/atm/atmconfig/main.c +++ sbin/atm/atmconfig/main.c @@ -872,8 +872,8 @@ register_module(const struct amodule *mod) { main_tab_size++; - if ((main_tab = realloc(main_tab, main_tab_size * sizeof(main_tab[0]))) - == NULL) + if ((main_tab = reallocarray(main_tab, main_tab_size, + sizeof(main_tab[0]))) == NULL) err(1, NULL); main_tab[main_tab_size - 2] = *mod->cmd; memset(&main_tab[main_tab_size - 1], 0, sizeof(main_tab[0])); Index: sbin/camcontrol/camcontrol.c =================================================================== --- sbin/camcontrol/camcontrol.c +++ sbin/camcontrol/camcontrol.c @@ -7922,9 +7922,9 @@ if (skip_device != 0) break; item->num_periphs++; - item->periph_matches = realloc( + item->periph_matches = reallocarray( item->periph_matches, - item->num_periphs * + item->num_periphs, sizeof(struct periph_match_result)); if (item->periph_matches == NULL) { warn("%s: error allocating periph " Index: sbin/ccdconfig/ccdconfig.c =================================================================== --- sbin/ccdconfig/ccdconfig.c +++ sbin/ccdconfig/ccdconfig.c @@ -312,8 +312,8 @@ for (cp = line; (cp = strtok(cp, " \t")) != NULL; cp = NULL) { if (*cp == '#') break; - if ((argv = realloc(argv, - sizeof(char *) * ++argc)) == NULL) { + if ((argv = reallocarray(argv, ++argc, + sizeof(char *))) == NULL) { warnx("no memory to configure ccds"); return (1); } Index: sbin/fsck_ffs/inode.c =================================================================== --- sbin/fsck_ffs/inode.c +++ sbin/fsck_ffs/inode.c @@ -472,8 +472,8 @@ inp->i_blks[UFS_NDADDR + i] = DIP(dp, di_ib[i]); if (inplast == listmax) { listmax += 100; - inpsort = (struct inoinfo **)realloc((char *)inpsort, - (unsigned)listmax * sizeof(struct inoinfo *)); + inpsort = (struct inoinfo **)reallocarray((char *)inpsort, + listmax, sizeof(struct inoinfo *)); if (inpsort == NULL) errx(EEXIT, "cannot increase directory list"); } Index: sbin/ipfw/ipfw2.c =================================================================== --- sbin/ipfw/ipfw2.c +++ sbin/ipfw/ipfw2.c @@ -2884,7 +2884,7 @@ if (tstate->count + 1 > tstate->size) { tstate->size += 4; - tstate->idx = realloc(tstate->idx, tstate->size * + tstate->idx = reallocarray(tstate->idx, tstate->size, sizeof(ipfw_obj_ntlv)); if (tstate->idx == NULL) return (0); Index: sbin/mount/getmntopts.c =================================================================== --- sbin/mount/getmntopts.c +++ sbin/mount/getmntopts.c @@ -146,7 +146,7 @@ if (*iovlen < 0) return; i = *iovlen; - *iov = realloc(*iov, sizeof **iov * (i + 2)); + *iov = reallocarray(*iov, i + 2, sizeof(**iov)); if (*iov == NULL) { *iovlen = -1; return; Index: sbin/mount/mount.c =================================================================== --- sbin/mount/mount.c +++ sbin/mount/mount.c @@ -541,7 +541,7 @@ { if (sa->c + 1 == sa->sz) { sa->sz = sa->sz == 0 ? 8 : sa->sz * 2; - sa->a = realloc(sa->a, sizeof(*sa->a) * sa->sz); + sa->a = reallocarray(sa->a, sa->sz, sizeof(*sa->a)); if (sa->a == NULL) errx(1, "realloc failed"); } Index: sbin/newfs_nandfs/newfs_nandfs.c =================================================================== --- sbin/newfs_nandfs/newfs_nandfs.c +++ sbin/newfs_nandfs/newfs_nandfs.c @@ -1041,8 +1041,8 @@ printf("cannot delete segment %jx (offset %jd)\n", i, offset); bad_segments_count++; - bad_segments = realloc(bad_segments, - bad_segments_count * sizeof(uint32_t)); + bad_segments = reallocarray(bad_segments, + bad_segments_count, sizeof(uint32_t)); bad_segments[bad_segments_count - 1] = i; } } Index: usr.bin/c99/c99.c =================================================================== --- usr.bin/c99/c99.c +++ usr.bin/c99/c99.c @@ -96,8 +96,8 @@ { if (nargs + 1 >= cargs) { cargs += 16; - if ((args = realloc(args, sizeof(*args) * cargs)) == NULL) - err(1, "malloc"); + if ((args = reallocarray(args, cargs, sizeof(*args))) == NULL) + err(1, "realloc"); } if ((args[nargs++] = strdup(item)) == NULL) err(1, "strdup"); Index: usr.bin/col/col.c =================================================================== --- usr.bin/col/col.c +++ usr.bin/col/col.c @@ -315,8 +315,8 @@ int need; need = l->l_lsize ? l->l_lsize * 2 : 90; - if ((l->l_line = realloc(l->l_line, - (unsigned)need * sizeof(CHAR))) == NULL) + if ((l->l_line = reallocarray(l->l_line, need, + sizeof(CHAR))) == NULL) err(1, NULL); l->l_lsize = need; } @@ -434,14 +434,14 @@ */ if (l->l_lsize > sorted_size) { sorted_size = l->l_lsize; - if ((sorted = realloc(sorted, - (unsigned)sizeof(CHAR) * sorted_size)) == NULL) + if ((sorted = reallocarray(sorted, sorted_size, + sizeof(CHAR))) == NULL) err(1, NULL); } if (l->l_max_col >= count_size) { count_size = l->l_max_col + 1; - if ((count = realloc(count, - (unsigned)sizeof(int) * count_size)) == NULL) + if ((count = reallocarray(count, count_size, + sizeof(int))) == NULL) err(1, NULL); } memset(count, 0, sizeof(int) * l->l_max_col + 1); @@ -552,7 +552,7 @@ int i; if (!line_freelist) { - if ((l = realloc(NULL, sizeof(LINE) * NALLOC)) == NULL) + if ((l = reallocarray(NULL, NALLOC, sizeof(LINE))) == NULL) err(1, NULL); line_freelist = l; for (i = 1; i < NALLOC; i++, l++) Index: usr.bin/colldef/parse.y =================================================================== --- usr.bin/colldef/parse.y +++ usr.bin/colldef/parse.y @@ -135,8 +135,8 @@ yyerror("Char 0x%02x can't be ordered since substituted", ch); } - if ((__collate_chain_pri_table = realloc(__collate_chain_pri_table, - sizeof(*__collate_chain_pri_table) * (chain_index + 1))) == NULL) + if ((__collate_chain_pri_table = reallocarray(__collate_chain_pri_table, + chain_index + 1, sizeof(*__collate_chain_pri_table))) == NULL) yyerror("can't grow chain table"); (void)memset(&__collate_chain_pri_table[chain_index], 0, sizeof(__collate_chain_pri_table[0])); @@ -221,8 +221,8 @@ __collate_char_pri_table[$1].prim = prim_pri++; } | chain { - if ((__collate_chain_pri_table = realloc(__collate_chain_pri_table, - sizeof(*__collate_chain_pri_table) * (chain_index + 1))) == NULL) + if ((__collate_chain_pri_table = reallocarray(__collate_chain_pri_table, + chain_index + 1, sizeof(*__collate_chain_pri_table))) == NULL) yyerror("can't grow chain table"); (void)memset(&__collate_chain_pri_table[chain_index], 0, sizeof(__collate_chain_pri_table[0])); @@ -275,8 +275,8 @@ } } | chain { - if ((__collate_chain_pri_table = realloc(__collate_chain_pri_table, - sizeof(*__collate_chain_pri_table) * (chain_index + 1))) == NULL) + if ((__collate_chain_pri_table = reallocarray(__collate_chain_pri_table, + chain_index + 1, sizeof(*__collate_chain_pri_table))) == NULL) yyerror("can't grow chain table"); (void)memset(&__collate_chain_pri_table[chain_index], 0, sizeof(__collate_chain_pri_table[0])); @@ -306,8 +306,8 @@ } } | chain { - if ((__collate_chain_pri_table = realloc(__collate_chain_pri_table, - sizeof(*__collate_chain_pri_table) * (chain_index + 1))) == NULL) + if ((__collate_chain_pri_table = reallocarray(__collate_chain_pri_table, + chain_index + 1, sizeof(*__collate_chain_pri_table))) == NULL) yyerror("can't grow chain table"); (void)memset(&__collate_chain_pri_table[chain_index], 0, sizeof(__collate_chain_pri_table[0])); Index: usr.bin/column/column.c =================================================================== --- usr.bin/column/column.c +++ usr.bin/column/column.c @@ -243,10 +243,10 @@ (cols[coloff] = wcstok(p, separator, &last)); p = NULL) if (++coloff == maxcols) { - if (!(cols = realloc(cols, ((u_int)maxcols + - DEFCOLS) * sizeof(wchar_t *))) || - !(lens = realloc(lens, - ((u_int)maxcols + DEFCOLS) * sizeof(int)))) + if (!(cols = reallocarray(cols, (u_int)maxcols + + DEFCOLS, sizeof(wchar_t *))) || + !(lens = reallocarray(lens, + (u_int)maxcols + DEFCOLS, sizeof(int)))) err(1, NULL); memset((char *)lens + maxcols * sizeof(int), 0, DEFCOLS * sizeof(int)); @@ -300,8 +300,8 @@ maxlength = len; if (entries == maxentry) { maxentry += DEFNUM; - if (!(list = realloc(list, - (u_int)maxentry * sizeof(*list)))) + if (!(list = reallocarray(list, + (u_int)maxentry, sizeof(*list)))) err(1, NULL); } list[entries] = malloc((wcslen(buf) + 1) * sizeof(wchar_t)); Index: usr.bin/fold/fold.c =================================================================== --- usr.bin/fold/fold.c +++ usr.bin/fold/fold.c @@ -189,7 +189,7 @@ } if (indx + 1 > buf_max) { buf_max += LINE_MAX; - buf = realloc(buf, sizeof(*buf) * buf_max); + buf = reallocarray(buf, buf_max, sizeof(*buf)); if (buf == NULL) err(1, "realloc()"); } Index: usr.bin/fortune/strfile/strfile.c =================================================================== --- usr.bin/fortune/strfile/strfile.c +++ usr.bin/fortune/strfile/strfile.c @@ -88,7 +88,8 @@ if (ptr == NULL) \ ptr = malloc(CHUNKSIZE * sizeof(*ptr)); \ else if (((sz) + 1) % CHUNKSIZE == 0) \ - ptr = realloc(ptr, ((sz) + CHUNKSIZE) * sizeof(*ptr)); \ + ptr = reallocarray(ptr, (sz) + CHUNKSIZE, \ + sizeof(*ptr)); \ if (ptr == NULL) { \ fprintf(stderr, "out of space\n"); \ exit(1); \ Index: usr.bin/indent/lexi.c =================================================================== --- usr.bin/indent/lexi.c +++ usr.bin/indent/lexi.c @@ -609,8 +609,8 @@ const char *copy; if (typename_top + 1 >= typename_count) { - typenames = realloc((void *)typenames, - sizeof(typenames[0]) * (typename_count *= 2)); + typenames = reallocarray((void *)typenames, typename_count *= 2, + sizeof(typenames[0])); if (typenames == NULL) err(1, NULL); } Index: usr.bin/join/join.c =================================================================== --- usr.bin/join/join.c +++ usr.bin/join/join.c @@ -292,8 +292,8 @@ if (F->setcnt == F->setalloc) { cnt = F->setalloc; F->setalloc += 50; - if ((F->set = realloc(F->set, - F->setalloc * sizeof(LINE))) == NULL) + if ((F->set = reallocarray(F->set, + F->setalloc, sizeof(LINE))) == NULL) err(1, NULL); memset(F->set + cnt, 0, 50 * sizeof(LINE)); @@ -343,8 +343,8 @@ continue; if (lp->fieldcnt == lp->fieldalloc) { lp->fieldalloc += 50; - if ((lp->fields = realloc(lp->fields, - lp->fieldalloc * sizeof(char *))) == NULL) + if ((lp->fields = reallocarray(lp->fields, + lp->fieldalloc, sizeof(char *))) == NULL) err(1, NULL); } lp->fields[lp->fieldcnt++] = fieldp; @@ -559,8 +559,8 @@ errx(1, "malformed -o option field"); if (olistcnt == olistalloc) { olistalloc += 50; - if ((olist = realloc(olist, - olistalloc * sizeof(OLIST))) == NULL) + if ((olist = reallocarray(olist, + olistalloc, sizeof(OLIST))) == NULL) err(1, NULL); } olist[olistcnt].filenum = filenum; Index: usr.bin/last/last.c =================================================================== --- usr.bin/last/last.c +++ usr.bin/last/last.c @@ -230,7 +230,7 @@ /* Load the last entries from the file. */ while ((ut = getutxent()) != NULL) { if (amount % 128 == 0) { - buf = realloc(buf, (amount + 128) * sizeof *ut); + buf = reallocarray(buf, amount + 128, sizeof(*ut)); if (buf == NULL) err(1, "realloc"); } Index: usr.bin/localedef/collate.c =================================================================== --- usr.bin/localedef/collate.c +++ usr.bin/localedef/collate.c @@ -267,7 +267,7 @@ if (numpri >= maxpri) { maxpri = maxpri ? maxpri * 2 : 1024; - prilist = realloc(prilist, sizeof (collpri_t) * maxpri); + prilist = reallocarray(prilist, maxpri, sizeof(collpri_t)); if (prilist == NULL) { fprintf(stderr,"out of memory"); return (-1); Index: usr.bin/localedef/scanner.c =================================================================== --- usr.bin/localedef/scanner.c +++ usr.bin/localedef/scanner.c @@ -374,7 +374,7 @@ { if ((wideidx + 1) >= widesz) { widesz += 64; - widestr = realloc(widestr, (widesz * sizeof (wchar_t))); + widestr = reallocarray(widestr, widesz, sizeof(wchar_t)); if (widestr == NULL) { yyerror("out of memory"); wideidx = 0; Index: usr.bin/locate/locate/util.c =================================================================== --- usr.bin/locate/locate/util.c +++ usr.bin/locate/locate/util.c @@ -120,8 +120,8 @@ *(p + slen) = '\0'; } /* increase dbv with element p */ - if ((dbv = realloc(dbv, sizeof(char *) * (vlen + 2))) - == NULL) + if ((dbv = reallocarray(dbv, vlen + 2, + sizeof(char *))) == NULL) err(1, "realloc"); *(dbv + vlen) = p; *(dbv + ++vlen) = NULL; Index: usr.bin/ministat/ministat.c =================================================================== --- usr.bin/ministat/ministat.c +++ usr.bin/ministat/ministat.c @@ -364,7 +364,7 @@ } m += 1; if (m > pl->height) { - pl->data = realloc(pl->data, pl->width * m); + pl->data = reallocarray(pl->data, m, pl->width); memset(pl->data + pl->height * pl->width, 0, (m - pl->height) * pl->width); } Index: usr.bin/mklocale/yacc.y =================================================================== --- usr.bin/mklocale/yacc.y +++ usr.bin/mklocale/yacc.y @@ -295,8 +295,7 @@ static uint32_t * xrelalloc(uint32_t *old, unsigned int sz) { - uint32_t *r = (uint32_t *)realloc((char *)old, - sz * sizeof(uint32_t)); + uint32_t *r = (uint32_t *)reallocarray((char *)old, sz, sizeof(uint32_t)); if (!r) errx(1, "xrelalloc"); return(r); Index: usr.bin/rs/rs.c =================================================================== --- usr.bin/rs/rs.c +++ usr.bin/rs/rs.c @@ -378,7 +378,7 @@ char **p; allocsize += allocsize; - p = (char **)realloc(elem, allocsize * sizeof(char *)); + p = reallocarray(elem, allocsize, sizeof(char *)); if (p == NULL) err(1, "no memory"); Index: usr.bin/ruptime/ruptime.c =================================================================== --- usr.bin/ruptime/ruptime.c +++ usr.bin/ruptime/ruptime.c @@ -213,8 +213,8 @@ } if (nhosts == hspace) { - if ((hs = - realloc(hs, (hspace += 40) * sizeof(*hs))) == NULL) + if ((hs = reallocarray(hs, hspace += 40, + sizeof(*hs))) == NULL) err(1, NULL); hsp = hs + nhosts; } Index: usr.bin/sed/process.c =================================================================== --- usr.bin/sed/process.c +++ usr.bin/sed/process.c @@ -120,9 +120,9 @@ goto redirect; case 'a': if (appendx >= appendnum) - if ((appends = realloc(appends, - sizeof(struct s_appends) * - (appendnum *= 2))) == NULL) + if ((appends = reallocarray(appends, + appendnum *= 2, + sizeof(struct s_appends))) == NULL) err(1, "realloc"); appends[appendx].type = AP_STRING; appends[appendx].s = cp->t; @@ -214,9 +214,9 @@ exit(0); case 'r': if (appendx >= appendnum) - if ((appends = realloc(appends, - sizeof(struct s_appends) * - (appendnum *= 2))) == NULL) + if ((appends = reallocarray(appends, + appendnum *= 2, + sizeof(struct s_appends))) == NULL) err(1, "realloc"); appends[appendx].type = AP_FILE; appends[appendx].s = cp->t; Index: usr.bin/systat/devs.c =================================================================== --- usr.bin/systat/devs.c +++ usr.bin/systat/devs.c @@ -285,10 +285,10 @@ num_devices_specified++; - specified_devices =(char **)realloc( + specified_devices = (char **)reallocarray( specified_devices, - sizeof(char *) * - num_devices_specified); + num_devices_specified, + sizeof(char *)); specified_devices[num_devices_specified -1]= strdup(tmpstr1); free(buffer); Index: usr.bin/systat/netcmds.c =================================================================== --- usr.bin/systat/netcmds.c +++ usr.bin/systat/netcmds.c @@ -214,9 +214,10 @@ return (0); } if (nports == 0) - ports = (struct pitem *)malloc(sizeof (*p)); + ports = (struct pitem *)malloc(sizeof(*p)); else - ports = (struct pitem *)realloc(ports, (nports+1)*sizeof (*p)); + ports = (struct pitem *)reallocarray(ports, nports + 1, + sizeof(*p)); p = &ports[nports++]; p->port = port; p->onoff = onoff; @@ -271,9 +272,10 @@ return (0); } if (nhosts == 0) - hosts = (struct hitem *)malloc(sizeof (*p)); + hosts = (struct hitem *)malloc(sizeof(*p)); else - hosts = (struct hitem *)realloc(hosts, (nhosts+1)*sizeof (*p)); + hosts = (struct hitem *)reallocarray(hosts, nhosts + 1, + sizeof(*p)); p = &hosts[nhosts++]; p->addr = *in; p->onoff = onoff; Index: usr.bin/top/machine.c =================================================================== --- usr.bin/top/machine.c +++ usr.bin/top/machine.c @@ -804,8 +804,8 @@ previous_interval += nsec / 1000; } if (nproc > onproc) { - pref = realloc(pref, sizeof(*pref) * nproc); - pcpu = realloc(pcpu, sizeof(*pcpu) * nproc); + pref = reallocarray(pref, nproc, sizeof(*pref)); + pcpu = reallocarray(pcpu, nproc, sizeof(*pcpu)); onproc = nproc; } if (pref == NULL || pbase == NULL || pcpu == NULL) { Index: usr.bin/ul/ul.c =================================================================== --- usr.bin/ul/ul.c +++ usr.bin/ul/ul.c @@ -181,7 +181,7 @@ obuf = NULL; copy = 1; } - obuf = realloc(obuf, sizeof(*obuf) * 2 * buflen); + obuf = reallocarray(obuf, 2 * buflen, sizeof(*obuf)); if (obuf == NULL) { obuf = sobuf; break; Index: usr.bin/vmstat/vmstat.c =================================================================== --- usr.bin/vmstat/vmstat.c +++ usr.bin/vmstat/vmstat.c @@ -397,9 +397,9 @@ if (isdigit(**argv)) break; num_devices_specified++; - specified_devices = (char **)realloc(specified_devices, - sizeof(char *) * - num_devices_specified); + specified_devices = reallocarray(specified_devices, + num_devices_specified, + sizeof(char *)); specified_devices[num_devices_specified - 1] = *argv; } dev_select = NULL; Index: usr.bin/whereis/whereis.c =================================================================== --- usr.bin/whereis/whereis.c +++ usr.bin/whereis/whereis.c @@ -119,7 +119,8 @@ dirlist = &sourcedirs; dolist: i = 0; - *dirlist = realloc(*dirlist, (i + 1) * sizeof(char *)); + *dirlist = reallocarray(*dirlist, i + 1, + sizeof(char *)); (*dirlist)[i] = NULL; while (optind < argc && strcmp(argv[optind], "-f") != 0 && @@ -206,7 +207,7 @@ if (cp) *cp = '\0'; if (strlen(s) && !contains(*cppp, s)) { - *cppp = realloc(*cppp, (*ip + 2) * sizeof(char *)); + *cppp = reallocarray(*cppp, *ip + 2, sizeof(char *)); if (*cppp == NULL) abort(); (*cppp)[*ip] = s; @@ -276,7 +277,7 @@ err(EX_OSERR, "sysctlbyname(\"user.cs_path\")"); nele = 0; decolonify(b, &bindirs, &nele); - bindirs = realloc(bindirs, (nele + 2) * sizeof(char *)); + bindirs = reallocarray(bindirs, nele + 2, sizeof(char *)); if (bindirs == NULL) abort(); bindirs[nele++] = PATH_LIBEXEC; @@ -363,8 +364,8 @@ free(b); continue; } - sourcedirs = realloc(sourcedirs, - (nele + 2) * sizeof(char *)); + sourcedirs = reallocarray(sourcedirs,nele + 2, + sizeof(char *)); if (sourcedirs == NULL) abort(); sourcedirs[nele++] = b; Index: usr.sbin/bsdinstall/partedit/part_wizard.c =================================================================== --- usr.sbin/bsdinstall/partedit/part_wizard.c +++ usr.sbin/bsdinstall/partedit/part_wizard.c @@ -128,7 +128,8 @@ if (strncmp(pp->lg_name, "cd", 2) == 0) continue; - disks = realloc(disks, (++n)*sizeof(disks[0])); + disks = reallocarray(disks, (++n), + sizeof(disks[0])); disks[n-1].name = pp->lg_name; humanize_number(diskdesc, 7, pp->lg_mediasize, "B", HN_AUTOSCALE, HN_DECIMAL); Index: usr.sbin/bsdinstall/partedit/partedit.c =================================================================== --- usr.sbin/bsdinstall/partedit/partedit.c +++ usr.sbin/bsdinstall/partedit/partedit.c @@ -485,8 +485,8 @@ if (strncmp(pp->lg_name, "cd", 2) == 0) continue; - *items = realloc(*items, - (*nitems+1)*sizeof(struct partedit_item)); + *items = reallocarray(*items, *nitems + 1, + sizeof(struct partedit_item)); (*items)[*nitems].indentation = recurse; (*items)[*nitems].name = pp->lg_name; (*items)[*nitems].size = pp->lg_mediasize; Index: usr.sbin/cron/lib/env.c =================================================================== --- usr.sbin/cron/lib/env.c +++ usr.sbin/cron/lib/env.c @@ -116,8 +116,7 @@ * one, save our string over the old null pointer, and return resized * array. */ - p = (char **) realloc((void *) envp, - (unsigned) ((count+1) * sizeof(char *))); + p = (char **)reallocarray((void *)envp, count + 1, sizeof(char *)); if (p == NULL) { /* XXX env_free(envp); */ errno = ENOMEM; Index: usr.sbin/inetd/inetd.c =================================================================== --- usr.sbin/inetd/inetd.c +++ usr.sbin/inetd/inetd.c @@ -2497,8 +2497,8 @@ LIST_FOREACH(conn, &sep->se_conn[i], co_link) { for (j = maxpip; j < conn->co_numchild; ++j) free_proc(conn->co_proc[j]); - conn->co_proc = realloc(conn->co_proc, - maxpip * sizeof(*conn->co_proc)); + conn->co_proc = reallocarray(conn->co_proc, + maxpip, sizeof(*conn->co_proc)); if (conn->co_proc == NULL) { syslog(LOG_ERR, "realloc: %m"); exit(EX_OSERR); Index: usr.sbin/iostat/iostat.c =================================================================== --- usr.sbin/iostat/iostat.c +++ usr.sbin/iostat/iostat.c @@ -351,9 +351,9 @@ if (isdigit(**argv)) break; num_devices_specified++; - specified_devices = (char **)realloc(specified_devices, - sizeof(char *) * - num_devices_specified); + specified_devices = reallocarray(specified_devices, + num_devices_specified, + sizeof(char *)); if (specified_devices == NULL) err(1, "realloc failed"); Index: usr.sbin/jls/jls.c =================================================================== --- usr.sbin/jls/jls.c +++ usr.sbin/jls/jls.c @@ -297,9 +297,9 @@ xo_err(1, "malloc"); } else if (nparams >= paramlistsize) { paramlistsize *= 2; - params = realloc(params, paramlistsize * sizeof(*params)); - param_parent = realloc(param_parent, - paramlistsize * sizeof(*param_parent)); + params = reallocarray(params, paramlistsize, sizeof(*params)); + param_parent = reallocarray(param_parent, + paramlistsize, sizeof(*param_parent)); if (params == NULL || param_parent == NULL) xo_err(1, "realloc"); } Index: usr.sbin/lastlogin/lastlogin.c =================================================================== --- usr.sbin/lastlogin/lastlogin.c +++ usr.sbin/lastlogin/lastlogin.c @@ -117,8 +117,8 @@ if (u->ut_type != USER_PROCESS) continue; if ((ulistsize % 16) == 0) { - ulist = realloc(ulist, - (ulistsize + 16) * sizeof(struct utmpx)); + ulist = reallocarray(ulist, + ulistsize + 16, sizeof(struct utmpx)); if (ulist == NULL) err(1, "malloc"); } Index: usr.sbin/mailwrapper/mailwrapper.c =================================================================== --- usr.sbin/mailwrapper/mailwrapper.c +++ usr.sbin/mailwrapper/mailwrapper.c @@ -73,7 +73,7 @@ if (al->argc == al->maxc) { al->maxc <<= 1; - al->argv = realloc(al->argv, al->maxc * sizeof(char *)); + al->argv = reallocarray(al->argv, al->maxc, sizeof(char *)); if (al->argv == NULL) err(EX_TEMPFAIL, "realloc"); } Index: usr.sbin/mountd/mountd.c =================================================================== --- usr.sbin/mountd/mountd.c +++ usr.sbin/mountd/mountd.c @@ -411,7 +411,7 @@ case 'h': ++nhosts; hosts_bak = hosts; - hosts_bak = realloc(hosts, nhosts * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts, sizeof(char *)); if (hosts_bak == NULL) { if (hosts != NULL) { for (k = 0; k < nhosts; k++) @@ -498,7 +498,7 @@ } else { hosts_bak = hosts; if (have_v6) { - hosts_bak = realloc(hosts, (nhosts + 2) * + hosts_bak = reallocarray(hosts, nhosts + 2, sizeof(char *)); if (hosts_bak == NULL) { for (k = 0; k < nhosts; k++) @@ -510,7 +510,8 @@ nhosts += 2; hosts[nhosts - 2] = "::1"; } else { - hosts_bak = realloc(hosts, (nhosts + 1) * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts + 1, + sizeof(char *)); if (hosts_bak == NULL) { for (k = 0; k < nhosts; k++) free(hosts[k]); @@ -575,8 +576,8 @@ * by saving the svcport_str and * setting it back to NULL. */ - port_list = realloc(port_list, - (port_len + 1) * sizeof(char *)); + port_list = reallocarray(port_list, + (port_len + 1), sizeof(char *)); if (port_list == NULL) out_of_mem(); port_list[port_len++] = svcport_str; @@ -692,7 +693,7 @@ nhostsbak = nhosts; while (nhostsbak > 0) { --nhostsbak; - sock_fd = realloc(sock_fd, (sock_fdcnt + 1) * sizeof(int)); + sock_fd = reallocarray(sock_fd, sock_fdcnt + 1, sizeof(int)); if (sock_fd == NULL) out_of_mem(); sock_fd[sock_fdcnt++] = -1; /* Set invalid for now. */ Index: usr.sbin/newsyslog/newsyslog.c =================================================================== --- usr.sbin/newsyslog/newsyslog.c +++ usr.sbin/newsyslog/newsyslog.c @@ -1568,8 +1568,8 @@ /* Detect integer overflow */ if (max_logcnt < logcnt) errx(1, "Too many old logfiles found"); - oldlogs = realloc(oldlogs, - max_logcnt * sizeof(struct oldlog_entry)); + oldlogs = reallocarray(oldlogs, max_logcnt, + sizeof(struct oldlog_entry)); if (oldlogs == NULL) err(1, "realloc()"); } @@ -1577,7 +1577,7 @@ /* Second, if needed we delete oldest archived logfiles */ if (logcnt > 0 && logcnt >= ent->numlogs && ent->numlogs > 1) { - oldlogs = realloc(oldlogs, logcnt * + oldlogs = reallocarray(oldlogs, logcnt, sizeof(struct oldlog_entry)); if (oldlogs == NULL) err(1, "realloc()"); Index: usr.sbin/nfsd/nfsd.c =================================================================== --- usr.sbin/nfsd/nfsd.c +++ usr.sbin/nfsd/nfsd.c @@ -186,7 +186,8 @@ break; case 'h': bindhostc++; - bindhost = realloc(bindhost,sizeof(char *)*bindhostc); + bindhost = reallocarray(bindhost, bindhostc, + sizeof(char *)); if (bindhost == NULL) errx(1, "Out of memory"); bindhost[bindhostc-1] = strdup(optarg); @@ -263,7 +264,7 @@ if (bindhostc == 0 || bindanyflag) { bindhostc++; - bindhost = realloc(bindhost,sizeof(char *)*bindhostc); + bindhost = reallocarray(bindhost, bindhostc, sizeof(char *)); if (bindhost == NULL) errx(1, "Out of memory"); bindhost[bindhostc-1] = strdup("*"); Index: usr.sbin/pmcstat/pmcpl_calltree.c =================================================================== --- usr.sbin/pmcstat/pmcpl_calltree.c +++ usr.sbin/pmcstat/pmcpl_calltree.c @@ -193,7 +193,7 @@ npmcs = samples->npmcs + max(pmcstat_npmcs - samples->npmcs, PMCPL_CT_GROWSIZE); - samples->sb = realloc(samples->sb, npmcs * sizeof(unsigned)); + samples->sb = reallocarray(samples->sb, npmcs, sizeof(unsigned)); if (samples->sb == NULL) errx(EX_SOFTWARE, "ERROR: out of memory"); bzero((char *)samples->sb + samples->npmcs * sizeof(unsigned), @@ -232,7 +232,7 @@ return; nmaxsize = *maxsize + max(cursize + 1 - *maxsize, PMCPL_CT_GROWSIZE); - *items = realloc(*items, nmaxsize * sizeof(struct pmcpl_ct_arc)); + *items = reallocarray(*items, nmaxsize, sizeof(struct pmcpl_ct_arc)); if (*items == NULL) errx(EX_SOFTWARE, "ERROR: out of memory"); bzero((char *)*items + *maxsize * sizeof(struct pmcpl_ct_arc), @@ -253,7 +253,7 @@ return; nmaxsize = *maxsize + max(cursize + 1 - *maxsize, PMCPL_CT_GROWSIZE); - *items = realloc(*items, nmaxsize * sizeof(struct pmcpl_ct_instr)); + *items = reallocarray(*items, nmaxsize, sizeof(struct pmcpl_ct_instr)); if (*items == NULL) errx(EX_SOFTWARE, "ERROR: out of memory"); bzero((char *)*items + *maxsize * sizeof(struct pmcpl_ct_instr), Index: usr.sbin/pmcstat/pmcstat_log.c =================================================================== --- usr.sbin/pmcstat/pmcstat_log.c +++ usr.sbin/pmcstat/pmcstat_log.c @@ -535,8 +535,8 @@ * Allocate space for the new entries. */ firsttime = image->pi_symbols == NULL; - symptr = realloc(image->pi_symbols, - sizeof(*symptr) * (image->pi_symcount + nfuncsyms)); + symptr = reallocarray(image->pi_symbols, + image->pi_symcount + nfuncsyms, sizeof(*symptr)); if (symptr == image->pi_symbols) /* realloc() failed. */ return; image->pi_symbols = symptr; @@ -587,8 +587,8 @@ * Return space to the system if there were duplicates. */ if (newsyms < nfuncsyms) - image->pi_symbols = realloc(image->pi_symbols, - sizeof(*symptr) * image->pi_symcount); + image->pi_symbols = reallocarray(image->pi_symbols, + image->pi_symcount, sizeof(*symptr)); /* * Keep the list of symbols sorted. Index: usr.sbin/portsnap/make_index/make_index.c =================================================================== --- usr.sbin/portsnap/make_index/make_index.c +++ usr.sbin/portsnap/make_index/make_index.c @@ -288,7 +288,7 @@ N++; if (N >= *nd) { *nd += *nd; - d = realloc(d, *nd * sizeof(DEP)); + d = reallocarray(d, *nd, sizeof(DEP)); if (d == NULL) err(1, "realloc(d)"); } @@ -452,7 +452,8 @@ /* Enlarge array if needed */ if (i >= pplen) { pplen *= 2; - if ((pp = realloc(pp, pplen * sizeof(PORT *))) == NULL) + if ((pp = reallocarray(pp, pplen, + sizeof(PORT *))) == NULL) err(1, "realloc(pp)"); } Index: usr.sbin/powerd/powerd.c =================================================================== --- usr.sbin/powerd/powerd.c +++ usr.sbin/powerd/powerd.c @@ -226,7 +226,7 @@ } *numfreqs = j; - if ((*freqs = realloc(*freqs, *numfreqs * sizeof(int))) == NULL) { + if ((*freqs = reallocarray(*freqs, *numfreqs, sizeof(int))) == NULL) { free(freqstr); free(*freqs); free(*power); Index: usr.sbin/ppp/iface.c =================================================================== --- usr.sbin/ppp/iface.c +++ usr.sbin/ppp/iface.c @@ -173,8 +173,8 @@ )) { /* Record the address */ - addr = (struct iface_addr *) - realloc(iface->addr, (iface->addrs + 1) * sizeof iface->addr[0]); + addr = reallocarray(iface->addr, iface->addrs + 1, + sizeof iface->addr[0]); if (addr == NULL) break; iface->addr = addr; @@ -575,8 +575,7 @@ } } - addr = (struct iface_addr *)realloc - (iface->addr, (iface->addrs + 1) * sizeof iface->addr[0]); + addr = reallocarray(iface->addr, (iface->addrs + 1), sizeof iface->addr[0]); if (addr == NULL) { log_Printf(LogERROR, "iface_inAdd: realloc: %s\n", strerror(errno)); close(s); Index: usr.sbin/ppp/ncp.c =================================================================== --- usr.sbin/ppp/ncp.c +++ usr.sbin/ppp/ncp.c @@ -387,8 +387,7 @@ if (range->nports == range->maxports) { range->maxports += 10; - newport = (u_short *)realloc(range->port, - range->maxports * sizeof(u_short)); + newport = reallocarray(range->port, range->maxports, sizeof(u_short)); if (newport == NULL) { log_Printf(LogERROR, "ncp_AddUrgentPort: realloc: %s\n", strerror(errno)); Index: usr.sbin/ppp/route.c =================================================================== --- usr.sbin/ppp/route.c +++ usr.sbin/ppp/route.c @@ -254,9 +254,9 @@ had = have; have = ifm->ifm_index + 5; if (had) - newifs = (char **)realloc(ifs, sizeof(char *) * have); + newifs = (char **)reallocarray(ifs, have, sizeof(char *)); else - newifs = (char **)malloc(sizeof(char *) * have); + newifs = (char **)malloc(have * sizeof(char *)); if (!newifs) { log_Printf(LogDEBUG, "Index2Nam: %s\n", strerror(errno)); route_nifs = 0; Index: usr.sbin/route6d/route6d.c =================================================================== --- usr.sbin/route6d/route6d.c +++ usr.sbin/route6d/route6d.c @@ -3544,24 +3544,24 @@ if (!index2ifc) { nindex2ifc = 5; /*initial guess*/ index2ifc = (struct ifc **) - malloc(sizeof(*index2ifc) * nindex2ifc); + malloc(nindex2ifc * sizeof(*index2ifc)); if (index2ifc == NULL) { fatal("malloc"); /*NOTREACHED*/ } - memset(index2ifc, 0, sizeof(*index2ifc) * nindex2ifc); + memset(index2ifc, 0, nindex2ifc * sizeof(*index2ifc)); } n = nindex2ifc; for (nsize = nindex2ifc; nsize <= idx; nsize *= 2) ; if (n != nsize) { - p = (struct ifc **)realloc(index2ifc, - sizeof(*index2ifc) * nsize); + p = (struct ifc **)reallocarray(index2ifc, nsize, + sizeof(*index2ifc)); if (p == NULL) { fatal("realloc"); /*NOTREACHED*/ } - memset(p + n, 0, sizeof(*index2ifc) * (nindex2ifc - n)); + memset(p + n, 0, (nindex2ifc - n) * sizeof(*index2ifc)); index2ifc = p; nindex2ifc = nsize; } Index: usr.sbin/rpc.lockd/lockd.c =================================================================== --- usr.sbin/rpc.lockd/lockd.c +++ usr.sbin/rpc.lockd/lockd.c @@ -145,7 +145,7 @@ case 'h': ++nhosts; hosts_bak = hosts; - hosts_bak = realloc(hosts, nhosts * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts, sizeof(char *)); if (hosts_bak == NULL) { if (hosts != NULL) { for (i = 0; i < nhosts; i++) @@ -229,7 +229,7 @@ } else { hosts_bak = hosts; if (have_v6) { - hosts_bak = realloc(hosts, (nhosts + 2) * + hosts_bak = reallocarray(hosts, nhosts + 2, sizeof(char *)); if (hosts_bak == NULL) { for (i = 0; i < nhosts; i++) @@ -242,7 +242,8 @@ nhosts += 2; hosts[nhosts - 2] = strdup("::1"); } else { - hosts_bak = realloc(hosts, (nhosts + 1) * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts + 1, + sizeof(char *)); if (hosts_bak == NULL) { for (i = 0; i < nhosts; i++) free(hosts[i]); @@ -372,8 +373,9 @@ * svcport_str and setting it * back to NULL. */ - port_list = realloc(port_list, - (port_len + 1) * + port_list = + reallocarray(port_list, + (port_len + 1), sizeof(char *)); if (port_list == NULL) out_of_mem(); @@ -528,7 +530,7 @@ nhostsbak = nhosts; while (nhostsbak > 0) { --nhostsbak; - sock_fd = realloc(sock_fd, (sock_fdcnt + 1) * sizeof(int)); + sock_fd = reallocarray(sock_fd, sock_fdcnt + 1, sizeof(int)); if (sock_fd == NULL) out_of_mem(); sock_fd[sock_fdcnt++] = -1; /* Set invalid for now. */ @@ -942,7 +944,7 @@ servaddr.buf = res->ai_addr; uaddr = taddr2uaddr(nconf, &servaddr); - addrs = realloc(addrs, 2 * (naddrs + 1) * sizeof(char *)); + addrs = reallocarray(addrs, 2 * (naddrs + 1), sizeof(char *)); if (!addrs) out_of_mem(); addrs[2 * naddrs] = strdup(nconf->nc_netid); Index: usr.sbin/rpc.statd/statd.c =================================================================== --- usr.sbin/rpc.statd/statd.c +++ usr.sbin/rpc.statd/statd.c @@ -98,7 +98,7 @@ case 'h': ++nhosts; hosts_bak = hosts; - hosts_bak = realloc(hosts, nhosts * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts, sizeof(char *)); if (hosts_bak == NULL) { if (hosts != NULL) { for (i = 0; i < nhosts; i++) @@ -159,7 +159,7 @@ } else { hosts_bak = hosts; if (have_v6) { - hosts_bak = realloc(hosts, (nhosts + 2) * + hosts_bak = reallocarray(hosts, (nhosts + 2), sizeof(char *)); if (hosts_bak == NULL) { for (i = 0; i < nhosts; i++) @@ -172,7 +172,7 @@ nhosts += 2; hosts[nhosts - 2] = "::1"; } else { - hosts_bak = realloc(hosts, (nhosts + 1) * sizeof(char *)); + hosts_bak = reallocarray(hosts, (nhosts + 1), sizeof(char *)); if (hosts_bak == NULL) { for (i = 0; i < nhosts; i++) free(hosts[i]); @@ -238,8 +238,8 @@ * by saving the svcport_str and * setting it back to NULL. */ - port_list = realloc(port_list, - (port_len + 1) * sizeof(char *)); + port_list = reallocarray(port_list, + port_len + 1, sizeof(char *)); if (port_list == NULL) out_of_mem(); port_list[port_len++] = svcport_str; @@ -353,7 +353,7 @@ nhostsbak = nhosts; while (nhostsbak > 0) { --nhostsbak; - sock_fd = realloc(sock_fd, (sock_fdcnt + 1) * sizeof(int)); + sock_fd = reallocarray(sock_fd, sock_fdcnt + 1, sizeof(int)); if (sock_fd == NULL) out_of_mem(); sock_fd[sock_fdcnt++] = -1; /* Set invalid for now. */ Index: usr.sbin/rpcbind/rpcbind.c =================================================================== --- usr.sbin/rpcbind/rpcbind.c +++ usr.sbin/rpcbind/rpcbind.c @@ -331,7 +331,7 @@ * Otherwise make sure 127.0.0.1 is added to the list. */ nhostsbak = nhosts + 1; - hosts = realloc(hosts, nhostsbak * sizeof(char *)); + hosts = reallocarray(hosts, nhostsbak, sizeof(char *)); if (nhostsbak == 1) hosts[0] = "*"; else { @@ -807,7 +807,7 @@ break; case 'h': ++nhosts; - hosts = realloc(hosts, nhosts * sizeof(char *)); + hosts = reallocarray(hosts, nhosts, sizeof(char *)); if (hosts == NULL) errx(1, "Out of memory"); hosts[nhosts - 1] = strdup(optarg); Index: usr.sbin/rtsold/rtsold.c =================================================================== --- usr.sbin/rtsold/rtsold.c +++ usr.sbin/rtsold/rtsold.c @@ -889,7 +889,7 @@ warnmsg(LOG_WARNING, __func__, "multiple interfaces found"); - a = realloc(argv, (n + 1) * sizeof(char *)); + a = reallocarray(argv, n + 1, sizeof(char *)); if (a == NULL) { warnmsg(LOG_ERR, __func__, "realloc"); exit(1); @@ -904,7 +904,7 @@ } if (n) { - a = realloc(argv, (n + 1) * sizeof(char *)); + a = reallocarray(argv, n + 1, sizeof(char *)); if (a == NULL) { warnmsg(LOG_ERR, __func__, "realloc"); exit(1); Index: usr.sbin/uhsoctl/uhsoctl.c =================================================================== --- usr.sbin/uhsoctl/uhsoctl.c +++ usr.sbin/uhsoctl/uhsoctl.c @@ -693,7 +693,7 @@ fprintf(stderr, "Save '%s'\n", resp); #endif - buf = realloc(ra->val[0].ptr, sizeof(char *) * (i + 1)); + buf = reallocarray(ra->val[0].ptr, i + 1, sizeof(char *)); if (buf == NULL) return; @@ -1117,14 +1117,15 @@ buf, error, error == 0 ? data : "FAILED"); #endif if (error == 0) { - list = realloc(list, (list_size + 1) * sizeof(char *)); + list = reallocarray(list, list_size + 1, + sizeof(char *)); list[list_size] = malloc(strlen(data) + strlen(TTY_NAME)); sprintf(list[list_size], TTY_NAME, data); list_size++; } } } - list = realloc(list, (list_size + 1) * sizeof(char *)); + list = reallocarray(list, list_size + 1, sizeof(char *)); list[list_size] = NULL; return (list); }