From 3127b0c5e28b1d4401206aac1a49f792a8976539 Mon Sep 17 00:00:00 2001
From: pk <pk@NetBSD.org>
Date: Sat, 7 Dec 1996 11:02:47 +0000
Subject: [PATCH] Fix short malloc & memory leak in union_relookup() (per
 Naofumi Honda; PR#3000).

---
 sys/miscfs/union/union_subr.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sys/miscfs/union/union_subr.c b/sys/miscfs/union/union_subr.c
index 687e8a6b4fdf..c3d527624fc9 100644
--- a/sys/miscfs/union/union_subr.c
+++ b/sys/miscfs/union/union_subr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: union_subr.c,v 1.21 1996/10/25 21:58:05 cgd Exp $	*/
+/*	$NetBSD: union_subr.c,v 1.22 1996/12/07 11:02:47 pk Exp $	*/
 
 /*
  * Copyright (c) 1994 Jan-Simon Pendry
@@ -741,6 +741,10 @@ union_relookup(um, dvp, vpp, cnp, cn, path, pathlen)
 	error = relookup(dvp, vpp, cn);
 	if (!error)
 		vrele(dvp);
+	else {
+		free(cn->cn_pnbuf, M_NAMEI);
+		cn->cn_pnbuf = 0;
+	}
 
 	return (error);
 }
@@ -883,7 +887,7 @@ union_vn_create(vpp, un, p)
 	 * copied in the first place).
 	 */
 	cn.cn_namelen = strlen(un->un_path);
-	cn.cn_pnbuf = (caddr_t) malloc(cn.cn_namelen, M_NAMEI, M_WAITOK);
+	cn.cn_pnbuf = (caddr_t) malloc(cn.cn_namelen+1, M_NAMEI, M_WAITOK);
 	bcopy(un->un_path, cn.cn_pnbuf, cn.cn_namelen+1);
 	cn.cn_nameiop = CREATE;
 	cn.cn_flags = (LOCKPARENT|HASBUF|SAVENAME|SAVESTART|ISLASTCN);