Index: bin/ls/print.c =================================================================== --- bin/ls/print.c (revision 327295) +++ bin/ls/print.c (working copy) @@ -385,8 +385,8 @@ * of pointers. */ if (dp->entries > lastentries) { - if ((narray = - realloc(array, dp->entries * sizeof(FTSENT *))) == NULL) { + if ((narray = reallocarray(array, dp->entries, + sizeof(FTSENT *))) == NULL) { printscol(dp); return; } Index: bin/pax/options.c =================================================================== --- bin/pax/options.c (revision 327295) +++ bin/pax/options.c (working copy) @@ -752,8 +752,8 @@ case 'I': if (++nincfiles > incfiles_max) { incfiles_max = nincfiles + 3; - incfiles = realloc(incfiles, - sizeof(*incfiles) * incfiles_max); + incfiles = reallocarray(incfiles, incfiles_max, + sizeof(*incfiles)); if (incfiles == NULL) { paxwarn(0, "Unable to allocate space " "for option list"); Index: bin/ps/ps.c =================================================================== --- bin/ps/ps.c (revision 327295) +++ bin/ps/ps.c (working copy) @@ -1124,7 +1124,7 @@ int newmax; newmax = (inf->maxcount + 1) << 1; - newlist = realloc(inf->l.ptr, newmax * inf->elemsize); + newlist = reallocarray(inf->l.ptr, newmax, inf->elemsize); if (newlist == NULL) { free(inf->l.ptr); xo_errx(1, "realloc to %d %ss failed", newmax, inf->lname); Index: lib/libutil/login_ok.c =================================================================== --- lib/libutil/login_ok.c (revision 327295) +++ lib/libutil/login_ok.c (working copy) @@ -101,7 +101,8 @@ ; if (*ltno >= j) lt = *ltptr; - else if ((lt = realloc(*ltptr, j * sizeof(struct login_time))) != NULL) { + else if ((lt = reallocarray(*ltptr, j, sizeof(struct login_time))) != + NULL) { *ltno = j; *ltptr = lt; } Index: sbin/camcontrol/camcontrol.c =================================================================== --- sbin/camcontrol/camcontrol.c (revision 327295) +++ sbin/camcontrol/camcontrol.c (working copy) @@ -8338,9 +8338,9 @@ if (skip_device != 0) break; item->num_periphs++; - item->periph_matches = realloc( + item->periph_matches = reallocarray( item->periph_matches, - item->num_periphs * + item->num_periphs, sizeof(struct periph_match_result)); if (item->periph_matches == NULL) { warn("%s: error allocating periph " Index: sbin/ccdconfig/ccdconfig.c =================================================================== --- sbin/ccdconfig/ccdconfig.c (revision 327295) +++ sbin/ccdconfig/ccdconfig.c (working copy) @@ -320,8 +320,8 @@ for (cp = line; (cp = strtok(cp, " \t")) != NULL; cp = NULL) { if (*cp == '#') break; - if ((argv = realloc(argv, - sizeof(char *) * ++argc)) == NULL) { + if ((argv = reallocarray(argv, ++argc, + sizeof(char *))) == NULL) { warnx("no memory to configure ccds"); return (1); } Index: sbin/ipfw/ipfw2.c =================================================================== --- sbin/ipfw/ipfw2.c (revision 327295) +++ sbin/ipfw/ipfw2.c (working copy) @@ -2910,7 +2910,7 @@ if (tstate->count + 1 > tstate->size) { tstate->size += 4; - tstate->idx = realloc(tstate->idx, tstate->size * + tstate->idx = reallocarray(tstate->idx, tstate->size, sizeof(ipfw_obj_ntlv)); if (tstate->idx == NULL) return (0); Index: sbin/mount/getmntopts.c =================================================================== --- sbin/mount/getmntopts.c (revision 327295) +++ sbin/mount/getmntopts.c (working copy) @@ -148,7 +148,7 @@ if (*iovlen < 0) return; i = *iovlen; - *iov = realloc(*iov, sizeof **iov * (i + 2)); + *iov = reallocarray(*iov, i + 2, sizeof(**iov)); if (*iov == NULL) { *iovlen = -1; return; Index: sbin/mount/mount.c =================================================================== --- sbin/mount/mount.c (revision 327295) +++ sbin/mount/mount.c (working copy) @@ -546,7 +546,7 @@ { if (sa->c + 1 == sa->sz) { sa->sz = sa->sz == 0 ? 8 : sa->sz * 2; - sa->a = realloc(sa->a, sizeof(*sa->a) * sa->sz); + sa->a = reallocarray(sa->a, sa->sz, sizeof(*sa->a)); if (sa->a == NULL) errx(1, "realloc failed"); } Index: usr.bin/c99/c99.c =================================================================== --- usr.bin/c99/c99.c (revision 327295) +++ usr.bin/c99/c99.c (working copy) @@ -98,8 +98,8 @@ { if (nargs + 1 >= cargs) { cargs += 16; - if ((args = realloc(args, sizeof(*args) * cargs)) == NULL) - err(1, "malloc"); + if ((args = reallocarray(args, cargs, sizeof(*args))) == NULL) + err(1, "realloc"); } if ((args[nargs++] = strdup(item)) == NULL) err(1, "strdup"); Index: usr.bin/col/col.c =================================================================== --- usr.bin/col/col.c (revision 327295) +++ usr.bin/col/col.c (working copy) @@ -317,8 +317,8 @@ int need; need = l->l_lsize ? l->l_lsize * 2 : 90; - if ((l->l_line = realloc(l->l_line, - (unsigned)need * sizeof(CHAR))) == NULL) + if ((l->l_line = reallocarray(l->l_line, need, + sizeof(CHAR))) == NULL) err(1, NULL); l->l_lsize = need; } @@ -436,14 +436,14 @@ */ if (l->l_lsize > sorted_size) { sorted_size = l->l_lsize; - if ((sorted = realloc(sorted, - (unsigned)sizeof(CHAR) * sorted_size)) == NULL) + if ((sorted = reallocarray(sorted, sorted_size, + sizeof(CHAR))) == NULL) err(1, NULL); } if (l->l_max_col >= count_size) { count_size = l->l_max_col + 1; - if ((count = realloc(count, - (unsigned)sizeof(int) * count_size)) == NULL) + if ((count = reallocarray(count, count_size, + sizeof(int))) == NULL) err(1, NULL); } memset(count, 0, sizeof(int) * l->l_max_col + 1); @@ -554,7 +554,7 @@ int i; if (!line_freelist) { - if ((l = realloc(NULL, sizeof(LINE) * NALLOC)) == NULL) + if ((l = reallocarray(NULL, NALLOC, sizeof(LINE))) == NULL) err(1, NULL); line_freelist = l; for (i = 1; i < NALLOC; i++, l++) Index: usr.bin/column/column.c =================================================================== --- usr.bin/column/column.c (revision 327295) +++ usr.bin/column/column.c (working copy) @@ -245,10 +245,10 @@ (cols[coloff] = wcstok(p, separator, &last)); p = NULL) if (++coloff == maxcols) { - if (!(cols = realloc(cols, ((u_int)maxcols + - DEFCOLS) * sizeof(wchar_t *))) || - !(lens = realloc(lens, - ((u_int)maxcols + DEFCOLS) * sizeof(int)))) + if (!(cols = reallocarray(cols, (u_int)maxcols + + DEFCOLS, sizeof(wchar_t *))) || + !(lens = reallocarray(lens, + (u_int)maxcols + DEFCOLS, sizeof(int)))) err(1, NULL); memset((char *)lens + maxcols * sizeof(int), 0, DEFCOLS * sizeof(int)); @@ -307,8 +307,8 @@ maxlength = len; if (entries == maxentry) { maxentry += DEFNUM; - if (!(list = realloc(list, - (u_int)maxentry * sizeof(*list)))) + if (!(list = reallocarray(list, + (u_int)maxentry, sizeof(*list)))) err(1, NULL); } list[entries] = malloc((wcslen(buf) + 1) * sizeof(wchar_t)); Index: usr.bin/fold/fold.c =================================================================== --- usr.bin/fold/fold.c (revision 327295) +++ usr.bin/fold/fold.c (working copy) @@ -191,7 +191,7 @@ } if (indx + 1 > buf_max) { buf_max += LINE_MAX; - buf = realloc(buf, sizeof(*buf) * buf_max); + buf = reallocarray(buf, buf_max, sizeof(*buf)); if (buf == NULL) err(1, "realloc()"); } Index: usr.bin/fortune/strfile/strfile.c =================================================================== --- usr.bin/fortune/strfile/strfile.c (revision 327295) +++ usr.bin/fortune/strfile/strfile.c (working copy) @@ -88,7 +88,8 @@ if (ptr == NULL) \ ptr = malloc(CHUNKSIZE * sizeof(*ptr)); \ else if (((sz) + 1) % CHUNKSIZE == 0) \ - ptr = realloc(ptr, ((sz) + CHUNKSIZE) * sizeof(*ptr)); \ + ptr = reallocarray(ptr, (sz) + CHUNKSIZE, \ + sizeof(*ptr)); \ if (ptr == NULL) { \ fprintf(stderr, "out of space\n"); \ exit(1); \ Index: usr.bin/indent/lexi.c =================================================================== --- usr.bin/indent/lexi.c (revision 327295) +++ usr.bin/indent/lexi.c (working copy) @@ -642,8 +642,8 @@ const char *copy; if (typename_top + 1 >= typename_count) { - typenames = realloc((void *)typenames, - sizeof(typenames[0]) * (typename_count *= 2)); + typenames = reallocarray((void *)typenames, typename_count *= 2, + sizeof(typenames[0])); if (typenames == NULL) err(1, NULL); } Index: usr.bin/join/join.c =================================================================== --- usr.bin/join/join.c (revision 327295) +++ usr.bin/join/join.c (working copy) @@ -294,8 +294,8 @@ if (F->setcnt == F->setalloc) { cnt = F->setalloc; F->setalloc += 50; - if ((F->set = realloc(F->set, - F->setalloc * sizeof(LINE))) == NULL) + if ((F->set = reallocarray(F->set, + F->setalloc, sizeof(LINE))) == NULL) err(1, NULL); memset(F->set + cnt, 0, 50 * sizeof(LINE)); @@ -345,8 +345,8 @@ continue; if (lp->fieldcnt == lp->fieldalloc) { lp->fieldalloc += 50; - if ((lp->fields = realloc(lp->fields, - lp->fieldalloc * sizeof(char *))) == NULL) + if ((lp->fields = reallocarray(lp->fields, + lp->fieldalloc, sizeof(char *))) == NULL) err(1, NULL); } lp->fields[lp->fieldcnt++] = fieldp; @@ -567,8 +567,8 @@ errx(1, "malformed -o option field"); if (olistcnt == olistalloc) { olistalloc += 50; - if ((olist = realloc(olist, - olistalloc * sizeof(OLIST))) == NULL) + if ((olist = reallocarray(olist, + olistalloc, sizeof(OLIST))) == NULL) err(1, NULL); } olist[olistcnt].filenum = filenum; Index: usr.bin/last/last.c =================================================================== --- usr.bin/last/last.c (revision 327295) +++ usr.bin/last/last.c (working copy) @@ -232,7 +232,7 @@ /* Load the last entries from the file. */ while ((ut = getutxent()) != NULL) { if (amount % 128 == 0) { - buf = realloc(buf, (amount + 128) * sizeof *ut); + buf = reallocarray(buf, amount + 128, sizeof(*ut)); if (buf == NULL) err(1, "realloc"); } Index: usr.bin/localedef/collate.c =================================================================== --- usr.bin/localedef/collate.c (revision 327295) +++ usr.bin/localedef/collate.c (working copy) @@ -267,7 +267,7 @@ if (numpri >= maxpri) { maxpri = maxpri ? maxpri * 2 : 1024; - prilist = realloc(prilist, sizeof (collpri_t) * maxpri); + prilist = reallocarray(prilist, maxpri, sizeof(collpri_t)); if (prilist == NULL) { fprintf(stderr,"out of memory"); return (-1); Index: usr.bin/localedef/ctype.c =================================================================== --- usr.bin/localedef/ctype.c (revision 327295) +++ usr.bin/localedef/ctype.c (working copy) @@ -412,8 +412,8 @@ ct[rl.runetype_ext_nranges-1].max = wc; } else { rl.runetype_ext_nranges++; - ct = realloc(ct, - sizeof (*ct) * rl.runetype_ext_nranges); + ct = reallocarray(ct, rl.runetype_ext_nranges, + sizeof (*ct)); ct[rl.runetype_ext_nranges - 1].min = wc; ct[rl.runetype_ext_nranges - 1].max = wc; ct[rl.runetype_ext_nranges - 1].map = ctn->ctype; @@ -427,8 +427,8 @@ last_lo = ctn; } else { rl.maplower_ext_nranges++; - lo = realloc(lo, - sizeof (*lo) * rl.maplower_ext_nranges); + lo = reallocarray(lo, rl.maplower_ext_nranges, + sizeof (*lo)); lo[rl.maplower_ext_nranges - 1].min = wc; lo[rl.maplower_ext_nranges - 1].max = wc; lo[rl.maplower_ext_nranges - 1].map = ctn->tolower; @@ -443,8 +443,8 @@ last_up = ctn; } else { rl.mapupper_ext_nranges++; - up = realloc(up, - sizeof (*up) * rl.mapupper_ext_nranges); + up = reallocarray(up, rl.mapupper_ext_nranges, + sizeof (*up)); up[rl.mapupper_ext_nranges - 1].min = wc; up[rl.mapupper_ext_nranges - 1].max = wc; up[rl.mapupper_ext_nranges - 1].map = ctn->toupper; Index: usr.bin/localedef/scanner.c =================================================================== --- usr.bin/localedef/scanner.c (revision 327295) +++ usr.bin/localedef/scanner.c (working copy) @@ -374,7 +374,7 @@ { if ((wideidx + 1) >= widesz) { widesz += 64; - widestr = realloc(widestr, (widesz * sizeof (wchar_t))); + widestr = reallocarray(widestr, widesz, sizeof(wchar_t)); if (widestr == NULL) { yyerror("out of memory"); wideidx = 0; Index: usr.bin/locate/locate/util.c =================================================================== --- usr.bin/locate/locate/util.c (revision 327295) +++ usr.bin/locate/locate/util.c (working copy) @@ -122,8 +122,8 @@ *(p + slen) = '\0'; } /* increase dbv with element p */ - if ((dbv = realloc(dbv, sizeof(char *) * (vlen + 2))) - == NULL) + if ((dbv = reallocarray(dbv, vlen + 2, + sizeof(char *))) == NULL) err(1, "realloc"); *(dbv + vlen) = p; *(dbv + ++vlen) = NULL; Index: usr.bin/ministat/ministat.c =================================================================== --- usr.bin/ministat/ministat.c (revision 327295) +++ usr.bin/ministat/ministat.c (working copy) @@ -366,7 +366,7 @@ } m += 1; if (m > pl->height) { - pl->data = realloc(pl->data, pl->width * m); + pl->data = reallocarray(pl->data, m, pl->width); memset(pl->data + pl->height * pl->width, 0, (m - pl->height) * pl->width); } Index: usr.bin/ruptime/ruptime.c =================================================================== --- usr.bin/ruptime/ruptime.c (revision 327295) +++ usr.bin/ruptime/ruptime.c (working copy) @@ -215,8 +215,8 @@ } if (nhosts == hspace) { - if ((hs = - realloc(hs, (hspace += 40) * sizeof(*hs))) == NULL) + if ((hs = reallocarray(hs, hspace += 40, + sizeof(*hs))) == NULL) err(1, NULL); hsp = hs + nhosts; } Index: usr.bin/sed/process.c =================================================================== --- usr.bin/sed/process.c (revision 327295) +++ usr.bin/sed/process.c (working copy) @@ -122,9 +122,9 @@ goto redirect; case 'a': if (appendx >= appendnum) - if ((appends = realloc(appends, - sizeof(struct s_appends) * - (appendnum *= 2))) == NULL) + if ((appends = reallocarray(appends, + appendnum *= 2, + sizeof(struct s_appends))) == NULL) err(1, "realloc"); appends[appendx].type = AP_STRING; appends[appendx].s = cp->t; @@ -216,9 +216,9 @@ exit(0); case 'r': if (appendx >= appendnum) - if ((appends = realloc(appends, - sizeof(struct s_appends) * - (appendnum *= 2))) == NULL) + if ((appends = reallocarray(appends, + appendnum *= 2, + sizeof(struct s_appends))) == NULL) err(1, "realloc"); appends[appendx].type = AP_FILE; appends[appendx].s = cp->t; Index: usr.bin/systat/devs.c =================================================================== --- usr.bin/systat/devs.c (revision 327295) +++ usr.bin/systat/devs.c (working copy) @@ -287,10 +287,10 @@ num_devices_specified++; - specified_devices =(char **)realloc( + specified_devices = (char **)reallocarray( specified_devices, - sizeof(char *) * - num_devices_specified); + num_devices_specified, + sizeof(char *)); specified_devices[num_devices_specified -1]= strdup(tmpstr1); free(buffer); Index: usr.bin/systat/netcmds.c =================================================================== --- usr.bin/systat/netcmds.c (revision 327295) +++ usr.bin/systat/netcmds.c (working copy) @@ -216,9 +216,10 @@ return (0); } if (nports == 0) - ports = (struct pitem *)malloc(sizeof (*p)); + ports = (struct pitem *)malloc(sizeof(*p)); else - ports = (struct pitem *)realloc(ports, (nports+1)*sizeof (*p)); + ports = (struct pitem *)reallocarray(ports, nports + 1, + sizeof(*p)); p = &ports[nports++]; p->port = port; p->onoff = onoff; @@ -273,9 +274,10 @@ return (0); } if (nhosts == 0) - hosts = (struct hitem *)malloc(sizeof (*p)); + hosts = (struct hitem *)malloc(sizeof(*p)); else - hosts = (struct hitem *)realloc(hosts, (nhosts+1)*sizeof (*p)); + hosts = (struct hitem *)reallocarray(hosts, nhosts + 1, + sizeof(*p)); p = &hosts[nhosts++]; p->addr = *in; p->onoff = onoff; Index: usr.bin/top/machine.c =================================================================== --- usr.bin/top/machine.c (revision 327295) +++ usr.bin/top/machine.c (working copy) @@ -843,8 +843,8 @@ previous_interval += nsec / 1000; } if (nproc > onproc) { - pref = realloc(pref, sizeof(*pref) * nproc); - pcpu = realloc(pcpu, sizeof(*pcpu) * nproc); + pref = reallocarray(pref, nproc, sizeof(*pref)); + pcpu = reallocarray(pcpu, nproc, sizeof(*pcpu)); onproc = nproc; } if (pref == NULL || pbase == NULL || pcpu == NULL) { Index: usr.bin/ul/ul.c =================================================================== --- usr.bin/ul/ul.c (revision 327295) +++ usr.bin/ul/ul.c (working copy) @@ -183,7 +183,7 @@ obuf = NULL; copy = 1; } - obuf = realloc(obuf, sizeof(*obuf) * 2 * buflen); + obuf = reallocarray(obuf, 2 * buflen, sizeof(*obuf)); if (obuf == NULL) { obuf = sobuf; break; Index: usr.bin/vmstat/vmstat.c =================================================================== --- usr.bin/vmstat/vmstat.c (revision 327295) +++ usr.bin/vmstat/vmstat.c (working copy) @@ -436,8 +436,8 @@ if (isdigit(**argv)) break; num_devices_specified++; - specified_devices = realloc(specified_devices, - sizeof(char *) * num_devices_specified); + specified_devices = reallocarray(specified_devices, + num_devices_specified, sizeof(char *)); specified_devices[num_devices_specified - 1] = *argv; } dev_select = NULL; Index: usr.bin/whereis/whereis.c =================================================================== --- usr.bin/whereis/whereis.c (revision 327295) +++ usr.bin/whereis/whereis.c (working copy) @@ -121,7 +121,8 @@ dirlist = &sourcedirs; dolist: i = 0; - *dirlist = realloc(*dirlist, (i + 1) * sizeof(char *)); + *dirlist = reallocarray(*dirlist, i + 1, + sizeof(char *)); (*dirlist)[i] = NULL; while (optind < argc && strcmp(argv[optind], "-f") != 0 && @@ -208,7 +209,7 @@ if (cp) *cp = '\0'; if (strlen(s) && !contains(*cppp, s)) { - *cppp = realloc(*cppp, (*ip + 2) * sizeof(char *)); + *cppp = reallocarray(*cppp, *ip + 2, sizeof(char *)); if (*cppp == NULL) abort(); (*cppp)[*ip] = s; @@ -278,7 +279,7 @@ err(EX_OSERR, "sysctlbyname(\"user.cs_path\")"); nele = 0; decolonify(b, &bindirs, &nele); - bindirs = realloc(bindirs, (nele + 2) * sizeof(char *)); + bindirs = reallocarray(bindirs, nele + 2, sizeof(char *)); if (bindirs == NULL) abort(); bindirs[nele++] = PATH_LIBEXEC; @@ -365,8 +366,8 @@ free(b); continue; } - sourcedirs = realloc(sourcedirs, - (nele + 2) * sizeof(char *)); + sourcedirs = reallocarray(sourcedirs,nele + 2, + sizeof(char *)); if (sourcedirs == NULL) abort(); sourcedirs[nele++] = b; Index: usr.sbin/bsdinstall/partedit/part_wizard.c =================================================================== --- usr.sbin/bsdinstall/partedit/part_wizard.c (revision 327295) +++ usr.sbin/bsdinstall/partedit/part_wizard.c (working copy) @@ -130,7 +130,8 @@ if (strncmp(pp->lg_name, "cd", 2) == 0) continue; - disks = realloc(disks, (++n)*sizeof(disks[0])); + disks = reallocarray(disks, (++n), + sizeof(disks[0])); disks[n-1].name = pp->lg_name; humanize_number(diskdesc, 7, pp->lg_mediasize, "B", HN_AUTOSCALE, HN_DECIMAL); Index: usr.sbin/bsdinstall/partedit/partedit.c =================================================================== --- usr.sbin/bsdinstall/partedit/partedit.c (revision 327295) +++ usr.sbin/bsdinstall/partedit/partedit.c (working copy) @@ -487,8 +487,8 @@ if (strncmp(pp->lg_name, "cd", 2) == 0) continue; - *items = realloc(*items, - (*nitems+1)*sizeof(struct partedit_item)); + *items = reallocarray(*items, *nitems + 1, + sizeof(struct partedit_item)); (*items)[*nitems].indentation = recurse; (*items)[*nitems].name = pp->lg_name; (*items)[*nitems].size = pp->lg_mediasize; Index: usr.sbin/cron/lib/env.c =================================================================== --- usr.sbin/cron/lib/env.c (revision 327295) +++ usr.sbin/cron/lib/env.c (working copy) @@ -116,8 +116,7 @@ * one, save our string over the old null pointer, and return resized * array. */ - p = (char **) realloc((void *) envp, - (unsigned) ((count+1) * sizeof(char *))); + p = (char **)reallocarray((void *)envp, count + 1, sizeof(char *)); if (p == NULL) { /* XXX env_free(envp); */ errno = ENOMEM; Index: usr.sbin/inetd/inetd.c =================================================================== --- usr.sbin/inetd/inetd.c (revision 327295) +++ usr.sbin/inetd/inetd.c (working copy) @@ -2479,8 +2479,8 @@ LIST_FOREACH(conn, &sep->se_conn[i], co_link) { for (j = maxpip; j < conn->co_numchild; ++j) free_proc(conn->co_proc[j]); - conn->co_proc = realloc(conn->co_proc, - maxpip * sizeof(*conn->co_proc)); + conn->co_proc = reallocarray(conn->co_proc, + maxpip, sizeof(*conn->co_proc)); if (conn->co_proc == NULL) { syslog(LOG_ERR, "realloc: %m"); exit(EX_OSERR); Index: usr.sbin/iostat/iostat.c =================================================================== --- usr.sbin/iostat/iostat.c (revision 327295) +++ usr.sbin/iostat/iostat.c (working copy) @@ -353,9 +353,9 @@ if (isdigit(**argv)) break; num_devices_specified++; - specified_devices = (char **)realloc(specified_devices, - sizeof(char *) * - num_devices_specified); + specified_devices = reallocarray(specified_devices, + num_devices_specified, + sizeof(char *)); if (specified_devices == NULL) err(1, "realloc failed"); Index: usr.sbin/jls/jls.c =================================================================== --- usr.sbin/jls/jls.c (revision 327295) +++ usr.sbin/jls/jls.c (working copy) @@ -299,9 +299,9 @@ xo_err(1, "malloc"); } else if (nparams >= paramlistsize) { paramlistsize *= 2; - params = realloc(params, paramlistsize * sizeof(*params)); - param_parent = realloc(param_parent, - paramlistsize * sizeof(*param_parent)); + params = reallocarray(params, paramlistsize, sizeof(*params)); + param_parent = reallocarray(param_parent, + paramlistsize, sizeof(*param_parent)); if (params == NULL || param_parent == NULL) xo_err(1, "realloc"); } Index: usr.sbin/lastlogin/lastlogin.c =================================================================== --- usr.sbin/lastlogin/lastlogin.c (revision 327295) +++ usr.sbin/lastlogin/lastlogin.c (working copy) @@ -119,8 +119,8 @@ if (u->ut_type != USER_PROCESS) continue; if ((ulistsize % 16) == 0) { - ulist = realloc(ulist, - (ulistsize + 16) * sizeof(struct utmpx)); + ulist = reallocarray(ulist, + ulistsize + 16, sizeof(struct utmpx)); if (ulist == NULL) err(1, "malloc"); } Index: usr.sbin/mailwrapper/mailwrapper.c =================================================================== --- usr.sbin/mailwrapper/mailwrapper.c (revision 327295) +++ usr.sbin/mailwrapper/mailwrapper.c (working copy) @@ -74,7 +74,7 @@ if (al->argc == al->maxc) { al->maxc <<= 1; - al->argv = realloc(al->argv, al->maxc * sizeof(char *)); + al->argv = reallocarray(al->argv, al->maxc, sizeof(char *)); if (al->argv == NULL) err(EX_TEMPFAIL, "realloc"); } Index: usr.sbin/mountd/mountd.c =================================================================== --- usr.sbin/mountd/mountd.c (revision 327295) +++ usr.sbin/mountd/mountd.c (working copy) @@ -416,7 +416,7 @@ case 'h': ++nhosts; hosts_bak = hosts; - hosts_bak = realloc(hosts, nhosts * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts, sizeof(char *)); if (hosts_bak == NULL) { if (hosts != NULL) { for (k = 0; k < nhosts; k++) @@ -501,7 +501,7 @@ } else { hosts_bak = hosts; if (have_v6) { - hosts_bak = realloc(hosts, (nhosts + 2) * + hosts_bak = reallocarray(hosts, nhosts + 2, sizeof(char *)); if (hosts_bak == NULL) { for (k = 0; k < nhosts; k++) @@ -513,7 +513,8 @@ nhosts += 2; hosts[nhosts - 2] = "::1"; } else { - hosts_bak = realloc(hosts, (nhosts + 1) * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts + 1, + sizeof(char *)); if (hosts_bak == NULL) { for (k = 0; k < nhosts; k++) free(hosts[k]); @@ -578,8 +579,8 @@ * by saving the svcport_str and * setting it back to NULL. */ - port_list = realloc(port_list, - (port_len + 1) * sizeof(char *)); + port_list = reallocarray(port_list, + (port_len + 1), sizeof(char *)); if (port_list == NULL) out_of_mem(); port_list[port_len++] = svcport_str; @@ -695,7 +696,7 @@ nhostsbak = nhosts; while (nhostsbak > 0) { --nhostsbak; - sock_fd = realloc(sock_fd, (sock_fdcnt + 1) * sizeof(int)); + sock_fd = reallocarray(sock_fd, sock_fdcnt + 1, sizeof(int)); if (sock_fd == NULL) out_of_mem(); sock_fd[sock_fdcnt++] = -1; /* Set invalid for now. */ Index: usr.sbin/newsyslog/newsyslog.c =================================================================== --- usr.sbin/newsyslog/newsyslog.c (revision 327295) +++ usr.sbin/newsyslog/newsyslog.c (working copy) @@ -1603,8 +1603,8 @@ /* Detect integer overflow */ if (max_logcnt < logcnt) errx(1, "Too many old logfiles found"); - oldlogs = realloc(oldlogs, - max_logcnt * sizeof(struct oldlog_entry)); + oldlogs = reallocarray(oldlogs, max_logcnt, + sizeof(struct oldlog_entry)); if (oldlogs == NULL) err(1, "realloc()"); } @@ -1612,7 +1612,7 @@ /* Second, if needed we delete oldest archived logfiles */ if (logcnt > 0 && logcnt >= ent->numlogs && ent->numlogs > 1) { - oldlogs = realloc(oldlogs, logcnt * + oldlogs = reallocarray(oldlogs, logcnt, sizeof(struct oldlog_entry)); if (oldlogs == NULL) err(1, "realloc()"); Index: usr.sbin/nfsd/nfsd.c =================================================================== --- usr.sbin/nfsd/nfsd.c (revision 327295) +++ usr.sbin/nfsd/nfsd.c (working copy) @@ -188,7 +188,8 @@ break; case 'h': bindhostc++; - bindhost = realloc(bindhost,sizeof(char *)*bindhostc); + bindhost = reallocarray(bindhost, bindhostc, + sizeof(char *)); if (bindhost == NULL) errx(1, "Out of memory"); bindhost[bindhostc-1] = strdup(optarg); @@ -265,7 +266,7 @@ if (bindhostc == 0 || bindanyflag) { bindhostc++; - bindhost = realloc(bindhost,sizeof(char *)*bindhostc); + bindhost = reallocarray(bindhost, bindhostc, sizeof(char *)); if (bindhost == NULL) errx(1, "Out of memory"); bindhost[bindhostc-1] = strdup("*"); Index: usr.sbin/portsnap/make_index/make_index.c =================================================================== --- usr.sbin/portsnap/make_index/make_index.c (revision 327295) +++ usr.sbin/portsnap/make_index/make_index.c (working copy) @@ -290,7 +290,7 @@ N++; if (N >= *nd) { *nd += *nd; - d = realloc(d, *nd * sizeof(DEP)); + d = reallocarray(d, *nd, sizeof(DEP)); if (d == NULL) err(1, "realloc(d)"); } @@ -454,7 +454,8 @@ /* Enlarge array if needed */ if (i >= pplen) { pplen *= 2; - if ((pp = realloc(pp, pplen * sizeof(PORT *))) == NULL) + if ((pp = reallocarray(pp, pplen, + sizeof(PORT *))) == NULL) err(1, "realloc(pp)"); } Index: usr.sbin/powerd/powerd.c =================================================================== --- usr.sbin/powerd/powerd.c (revision 327295) +++ usr.sbin/powerd/powerd.c (working copy) @@ -228,7 +228,7 @@ } *numfreqs = j; - if ((*freqs = realloc(*freqs, *numfreqs * sizeof(int))) == NULL) { + if ((*freqs = reallocarray(*freqs, *numfreqs, sizeof(int))) == NULL) { free(freqstr); free(*freqs); free(*power); Index: usr.sbin/ppp/iface.c =================================================================== --- usr.sbin/ppp/iface.c (revision 327295) +++ usr.sbin/ppp/iface.c (working copy) @@ -176,8 +176,8 @@ )) { /* Record the address */ - addr = (struct iface_addr *) - realloc(iface->addr, (iface->addrs + 1) * sizeof iface->addr[0]); + addr = reallocarray(iface->addr, iface->addrs + 1, + sizeof iface->addr[0]); if (addr == NULL) break; iface->addr = addr; @@ -578,8 +578,7 @@ } } - addr = (struct iface_addr *)realloc - (iface->addr, (iface->addrs + 1) * sizeof iface->addr[0]); + addr = reallocarray(iface->addr, (iface->addrs + 1), sizeof iface->addr[0]); if (addr == NULL) { log_Printf(LogERROR, "iface_inAdd: realloc: %s\n", strerror(errno)); close(s); Index: usr.sbin/ppp/ncp.c =================================================================== --- usr.sbin/ppp/ncp.c (revision 327295) +++ usr.sbin/ppp/ncp.c (working copy) @@ -389,8 +389,7 @@ if (range->nports == range->maxports) { range->maxports += 10; - newport = (u_short *)realloc(range->port, - range->maxports * sizeof(u_short)); + newport = reallocarray(range->port, range->maxports, sizeof(u_short)); if (newport == NULL) { log_Printf(LogERROR, "ncp_AddUrgentPort: realloc: %s\n", strerror(errno)); Index: usr.sbin/ppp/route.c =================================================================== --- usr.sbin/ppp/route.c (revision 327295) +++ usr.sbin/ppp/route.c (working copy) @@ -256,9 +256,9 @@ had = have; have = ifm->ifm_index + 5; if (had) - newifs = (char **)realloc(ifs, sizeof(char *) * have); + newifs = (char **)reallocarray(ifs, have, sizeof(char *)); else - newifs = (char **)malloc(sizeof(char *) * have); + newifs = (char **)malloc(have * sizeof(char *)); if (!newifs) { log_Printf(LogDEBUG, "Index2Nam: %s\n", strerror(errno)); route_nifs = 0; Index: usr.sbin/route6d/route6d.c =================================================================== --- usr.sbin/route6d/route6d.c (revision 327295) +++ usr.sbin/route6d/route6d.c (working copy) @@ -3556,24 +3556,24 @@ if (!index2ifc) { nindex2ifc = 5; /*initial guess*/ index2ifc = (struct ifc **) - malloc(sizeof(*index2ifc) * nindex2ifc); + malloc(nindex2ifc * sizeof(*index2ifc)); if (index2ifc == NULL) { fatal("malloc"); /*NOTREACHED*/ } - memset(index2ifc, 0, sizeof(*index2ifc) * nindex2ifc); + memset(index2ifc, 0, nindex2ifc * sizeof(*index2ifc)); } n = nindex2ifc; for (nsize = nindex2ifc; nsize <= idx; nsize *= 2) ; if (n != nsize) { - p = (struct ifc **)realloc(index2ifc, - sizeof(*index2ifc) * nsize); + p = (struct ifc **)reallocarray(index2ifc, nsize, + sizeof(*index2ifc)); if (p == NULL) { fatal("realloc"); /*NOTREACHED*/ } - memset(p + n, 0, sizeof(*index2ifc) * (nindex2ifc - n)); + memset(p + n, 0, (nindex2ifc - n) * sizeof(*index2ifc)); index2ifc = p; nindex2ifc = nsize; } Index: usr.sbin/rpc.lockd/lockd.c =================================================================== --- usr.sbin/rpc.lockd/lockd.c (revision 327295) +++ usr.sbin/rpc.lockd/lockd.c (working copy) @@ -145,7 +145,7 @@ break; case 'h': ++nhosts; - hosts_bak = realloc(hosts, nhosts * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts, sizeof(char *)); if (hosts_bak == NULL) { if (hosts != NULL) { for (i = 0; i < nhosts; i++) @@ -227,7 +227,7 @@ nhosts = 1; } else { if (have_v6) { - hosts_bak = realloc(hosts, (nhosts + 2) * + hosts_bak = reallocarray(hosts, nhosts + 2, sizeof(char *)); if (hosts_bak == NULL) { for (i = 0; i < nhosts; i++) @@ -240,7 +240,8 @@ nhosts += 2; hosts[nhosts - 2] = strdup("::1"); } else { - hosts_bak = realloc(hosts, (nhosts + 1) * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts + 1, + sizeof(char *)); if (hosts_bak == NULL) { for (i = 0; i < nhosts; i++) free(hosts[i]); @@ -370,8 +371,9 @@ * svcport_str and setting it * back to NULL. */ - port_list = realloc(port_list, - (port_len + 1) * + port_list = + reallocarray(port_list, + (port_len + 1), sizeof(char *)); if (port_list == NULL) out_of_mem(); @@ -535,7 +537,8 @@ hints.ai_flags = AI_PASSIVE; if (!kernel_lockd) { - sock_fd = realloc(sock_fd, (sock_fdcnt + 1) * sizeof(int)); + sock_fd = reallocarray(sock_fd, (sock_fdcnt + 1), + sizeof(int)); if (sock_fd == NULL) out_of_mem(); sock_fd[sock_fdcnt++] = -1; /* Set invalid for now. */ @@ -662,7 +665,8 @@ servaddr.buf = res->ai_addr; uaddr = taddr2uaddr(nconf, &servaddr); - addrs = realloc(addrs, 2 * (naddrs + 1) * sizeof(char *)); + addrs = reallocarray(addrs, naddrs + 1, + 2 * sizeof(char *)); if (!addrs) out_of_mem(); addrs[2 * naddrs] = strdup(nconf->nc_netid); Index: usr.sbin/rpc.statd/statd.c =================================================================== --- usr.sbin/rpc.statd/statd.c (revision 327295) +++ usr.sbin/rpc.statd/statd.c (working copy) @@ -100,7 +100,7 @@ case 'h': ++nhosts; hosts_bak = hosts; - hosts_bak = realloc(hosts, nhosts * sizeof(char *)); + hosts_bak = reallocarray(hosts, nhosts, sizeof(char *)); if (hosts_bak == NULL) { if (hosts != NULL) { for (i = 0; i < nhosts; i++) @@ -161,7 +161,7 @@ } else { hosts_bak = hosts; if (have_v6) { - hosts_bak = realloc(hosts, (nhosts + 2) * + hosts_bak = reallocarray(hosts, (nhosts + 2), sizeof(char *)); if (hosts_bak == NULL) { for (i = 0; i < nhosts; i++) @@ -174,7 +174,7 @@ nhosts += 2; hosts[nhosts - 2] = "::1"; } else { - hosts_bak = realloc(hosts, (nhosts + 1) * sizeof(char *)); + hosts_bak = reallocarray(hosts, (nhosts + 1), sizeof(char *)); if (hosts_bak == NULL) { for (i = 0; i < nhosts; i++) free(hosts[i]); @@ -240,8 +240,8 @@ * by saving the svcport_str and * setting it back to NULL. */ - port_list = realloc(port_list, - (port_len + 1) * sizeof(char *)); + port_list = reallocarray(port_list, + port_len + 1, sizeof(char *)); if (port_list == NULL) out_of_mem(); port_list[port_len++] = svcport_str; @@ -355,7 +355,7 @@ nhostsbak = nhosts; while (nhostsbak > 0) { --nhostsbak; - sock_fd = realloc(sock_fd, (sock_fdcnt + 1) * sizeof(int)); + sock_fd = reallocarray(sock_fd, sock_fdcnt + 1, sizeof(int)); if (sock_fd == NULL) out_of_mem(); sock_fd[sock_fdcnt++] = -1; /* Set invalid for now. */ Index: usr.sbin/rpcbind/rpcbind.c =================================================================== --- usr.sbin/rpcbind/rpcbind.c (revision 327295) +++ usr.sbin/rpcbind/rpcbind.c (working copy) @@ -333,7 +333,7 @@ * Otherwise make sure 127.0.0.1 is added to the list. */ nhostsbak = nhosts + 1; - hosts = realloc(hosts, nhostsbak * sizeof(char *)); + hosts = reallocarray(hosts, nhostsbak, sizeof(char *)); if (nhostsbak == 1) hosts[0] = "*"; else { @@ -810,7 +810,7 @@ break; case 'h': ++nhosts; - hosts = realloc(hosts, nhosts * sizeof(char *)); + hosts = reallocarray(hosts, nhosts, sizeof(char *)); if (hosts == NULL) errx(1, "Out of memory"); hosts[nhosts - 1] = strdup(optarg); Index: usr.sbin/rtsold/rtsold.c =================================================================== --- usr.sbin/rtsold/rtsold.c (revision 327295) +++ usr.sbin/rtsold/rtsold.c (working copy) @@ -891,7 +891,7 @@ warnmsg(LOG_WARNING, __func__, "multiple interfaces found"); - a = realloc(argv, (n + 1) * sizeof(char *)); + a = reallocarray(argv, n + 1, sizeof(char *)); if (a == NULL) { warnmsg(LOG_ERR, __func__, "realloc"); exit(1); @@ -906,7 +906,7 @@ } if (n) { - a = realloc(argv, (n + 1) * sizeof(char *)); + a = reallocarray(argv, n + 1, sizeof(char *)); if (a == NULL) { warnmsg(LOG_ERR, __func__, "realloc"); exit(1); Index: usr.sbin/uhsoctl/uhsoctl.c =================================================================== --- usr.sbin/uhsoctl/uhsoctl.c (revision 327295) +++ usr.sbin/uhsoctl/uhsoctl.c (working copy) @@ -695,7 +695,7 @@ fprintf(stderr, "Save '%s'\n", resp); #endif - buf = realloc(ra->val[0].ptr, sizeof(char *) * (i + 1)); + buf = reallocarray(ra->val[0].ptr, i + 1, sizeof(char *)); if (buf == NULL) return; @@ -1023,7 +1023,8 @@ get_tty(struct ctx *ctx) { char buf[64], data[128]; - int error, i, usbport, usbport0, list_size = 0; + int error, i, usbport, usbport0; + u_int list_size = 0; char **list = NULL; size_t len; const char **p, *q; @@ -1119,7 +1120,8 @@ buf, error, error == 0 ? data : "FAILED"); #endif if (error == 0) { - list = realloc(list, (list_size + 1) * sizeof(char *)); + list = reallocarray(list, list_size + 1, + sizeof(char *)); list[list_size] = malloc(strlen(data) + strlen(TTY_NAME)); sprintf(list[list_size], TTY_NAME, data); list_size++; @@ -1126,7 +1128,7 @@ } } } - list = realloc(list, (list_size + 1) * sizeof(char *)); + list = reallocarray(list, list_size + 1, sizeof(char *)); list[list_size] = NULL; return (list); }