A bug in message_add_payload()

Dear Sir/Madam,

I am currently inspecting the isakmpd code of your 3.2 release with the view to port it.

In message_add_payload() there is a call to realloc() as follows:   new_iov

• (struct iovec *)realloc (msg->iov, (msg->iovlen + 1) * sizeof *msg->iov);

This code relies upon the new memory block being cleared to 0 and causes a memory crash in systems whose memory is not cleared. In fact to be consistent with message_alloc() any new memory obtained for msg->iov should ensure that the rest of memory is cleared, since in message_alloc() the memory obtained for msg->iov is using calloc().

Kind regards,

Aref Taidi
Principal Software Engineer
Avaya, Welwyn Garden City, UK
Tel: +44 (0) 1707 364657
email: ataidi@avaya.com Received on Tue Apr 15 13:31:49 2003