base/SOURCES/0120-RHBZ-1043093-realloc-fix.patch

---
 libmultipath/dmparser.c   |    6 ++++--
 libmultipath/regex.c      |    9 ++++++++-
 multipath/main.c          |    9 ++++++---
 multipathd/cli_handlers.c |   41 ++++++++++++-----------------------------
 multipathd/uxlsnr.c       |   13 ++++++++++++-
 5 files changed, 42 insertions(+), 36 deletions(-)

Index: multipath-tools-130222/libmultipath/dmparser.c
===================================================================
--- multipath-tools-130222.orig/libmultipath/dmparser.c
+++ multipath-tools-130222/libmultipath/dmparser.c
@@ -20,14 +20,16 @@
 static int
 merge_words (char ** dst, char * word, int space)
 {
-	char * p;
+	char * p = *dst;
 	int len;
 
 	len = strlen(*dst) + strlen(word) + space;
 	*dst = REALLOC(*dst, len + 1);
 
-	if (!*dst)
+	if (!*dst) {
+		free(p);
 		return 1;
+	}
 
 	p = *dst;
 
Index: multipath-tools-130222/libmultipath/regex.c
===================================================================
--- multipath-tools-130222.orig/libmultipath/regex.c
+++ multipath-tools-130222/libmultipath/regex.c
@@ -123,7 +123,14 @@ static void init_syntax_once(void)
 
 /* (Re)Allocate N items of type T using malloc, or fail.  */
 #define TALLOC(n, t)	     ((t *) malloc ((n) * sizeof (t)))
-#define RETALLOC(addr, n, t) ((addr) = (t *) realloc (addr, (n) * sizeof (t)))
+#define RETALLOC(addr, n, t)                                            \
+do {                                                                    \
+	t *tmp = (t *) realloc (addr, (n) * sizeof (t));                \
+	if (!tmp)                                                       \
+		free(addr);                                             \
+	(addr) = tmp;                                                   \
+} while(0)
+
 #define REGEX_TALLOC(n, t)   ((t *) REGEX_ALLOCATE ((n) * sizeof (t)))
 
 #define BYTEWIDTH 8		/* In bits.  */
Index: multipath-tools-130222/multipath/main.c
===================================================================
--- multipath-tools-130222.orig/multipath/main.c
+++ multipath-tools-130222/multipath/main.c
@@ -394,7 +394,7 @@ out:
 static int
 dump_config (void)
 {
-	char * c;
+	char * c, * tmp = NULL;
 	char * reply;
 	unsigned int maxlen = 256;
 	int again = 1;
@@ -402,9 +402,12 @@ dump_config (void)
 	reply = MALLOC(maxlen);
 
 	while (again) {
-		if (!reply)
+		if (!reply) {
+			if (tmp)
+				free(tmp);
 			return 1;
-		c = reply;
+		}
+		c = tmp = reply;
 		c += snprint_defaults(c, reply + maxlen - c);
 		again = ((c - reply) == maxlen);
 		if (again) {
Index: multipath-tools-130222/multipathd/cli_handlers.c
===================================================================
--- multipath-tools-130222.orig/multipathd/cli_handlers.c
+++ multipath-tools-130222/multipathd/cli_handlers.c
@@ -26,11 +26,14 @@
 #define REALLOC_REPLY(r, a, m)					\
 	do {							\
 		if ((a)) {					\
+			char *tmp = (r);			\
 			(r) = REALLOC((r), (m) * 2);		\
 			if ((r)) {				\
 				memset((r) + (m), 0, (m));	\
 				(m) *= 2;			\
 			}					\
+			else					\
+				free(tmp);			\
 		}						\
 	} while (0)
 
@@ -144,7 +147,7 @@ show_config (char ** r, int * len)
 	unsigned int maxlen = INITIAL_REPLY_LEN;
 	int again = 1;
 
-	reply = MALLOC(maxlen);
+	c = reply = MALLOC(maxlen);
 
 	while (again) {
 		if (!reply)
@@ -152,44 +155,24 @@ show_config (char ** r, int * len)
 		c = reply;
 		c += snprint_defaults(c, reply + maxlen - c);
 		again = ((c - reply) == maxlen);
-		if (again) {
-			reply = REALLOC(reply, maxlen * 2);
-			if (!reply)
-				return 1;
-			memset(reply + maxlen, 0, maxlen);
-			maxlen *= 2;
+		REALLOC_REPLY(reply, again, maxlen);
+		if (again)
 			continue;
-		}
 		c += snprint_blacklist(c, reply + maxlen - c);
 		again = ((c - reply) == maxlen);
-		if (again) {
-			reply = REALLOC(reply, maxlen * 2);
-			if (!reply)
-				return 1;
-			memset(reply + maxlen, 0, maxlen);
-			maxlen *= 2;
+		REALLOC_REPLY(reply, again, maxlen);
+		if (again)
 			continue;
-		}
 		c += snprint_blacklist_except(c, reply + maxlen - c);
 		again = ((c - reply) == maxlen);
-		if (again) {
-			reply = REALLOC(reply, maxlen * 2);
-			if (!reply)
-				return 1;
-			memset(reply + maxlen, 0, maxlen);
-			maxlen *= 2;
+		REALLOC_REPLY(reply, again, maxlen);
+		if (again)
 			continue;
-		}
 		c += snprint_hwtable(c, reply + maxlen - c, conf->hwtable);
 		again = ((c - reply) == maxlen);
-		if (again) {
-			reply = REALLOC(reply, maxlen * 2);
-			if (!reply)
-				return 1;
-			memset(reply + maxlen, 0, maxlen);
-			maxlen *= 2;
+		REALLOC_REPLY(reply, again, maxlen);
+		if (again)
 			continue;
-		}
 		c += snprint_mptable(c, reply + maxlen - c, conf->mptable);
 		again = ((c - reply) == maxlen);
 		REALLOC_REPLY(reply, again, maxlen);
Index: multipath-tools-130222/multipathd/uxlsnr.c
===================================================================
--- multipath-tools-130222.orig/multipathd/uxlsnr.c
+++ multipath-tools-130222/multipathd/uxlsnr.c
@@ -64,6 +64,10 @@ static void new_client(int ux_sock)
 
 	/* put it in our linked list */
 	c = (struct client *)MALLOC(sizeof(*c));
+	if (!c) {
+		close(fd);
+		return;
+	}
 	memset(c, 0, sizeof(*c));
 	c->fd = fd;
 	c->next = clients;
@@ -124,11 +128,18 @@ void * uxsock_listen(int (*uxsock_trigge
 	sigdelset(&mask, SIGHUP);
 	sigdelset(&mask, SIGUSR1);
 	while (1) {
+		struct pollfd *tmp;
 		struct client *c;
 		int i, poll_count;
 
 		/* setup for a poll */
-		polls = REALLOC(polls, (1+num_clients) * sizeof(*polls));
+		tmp = REALLOC(polls, (1+num_clients) * sizeof(*polls));
+		/* If we can't allocate poliing space for the new client,
+		 * close it */
+		if (!tmp)
+			dead_client(clients);
+		else
+			polls = tmp;
 		polls[0].fd = ux_sock;
 		polls[0].events = POLLIN;