From 434c034061ee4f890b60c7d4b4fef1246e188801 Mon Sep 17 00:00:00 2001
From: itojun <itojun@NetBSD.org>
Date: Fri, 7 Nov 2003 04:44:57 +0000
Subject: [PATCH] safer realloc, from openbsd

---
 usr.bin/sed/process.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/usr.bin/sed/process.c b/usr.bin/sed/process.c
index 83b931f5e719..94e32c557b0f 100644
--- a/usr.bin/sed/process.c
+++ b/usr.bin/sed/process.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: process.c,v 1.34 2003/11/07 03:58:06 itojun Exp $	*/
+/*	$NetBSD: process.c,v 1.35 2003/11/07 04:44:57 itojun Exp $	*/
 
 /*-
  * Copyright (c) 1992, 1993, 1994
@@ -72,7 +72,7 @@
 #if 0
 static char sccsid[] = "@(#)process.c	8.6 (Berkeley) 4/20/94";
 #else
-__RCSID("$NetBSD: process.c,v 1.34 2003/11/07 03:58:06 itojun Exp $");
+__RCSID("$NetBSD: process.c,v 1.35 2003/11/07 04:44:57 itojun Exp $");
 #endif
 #endif /* not lint */
 
@@ -145,10 +145,12 @@ redirect:
 				cp = cp->u.c;
 				goto redirect;
 			case 'a':
-				if (appendx >= appendnum)
+				if (appendx >= appendnum) {
 					appends = xrealloc(appends,
 					    sizeof(struct s_appends) *
-					    (appendnum *= 2));
+					    (appendnum * 2));
+					appendnum *= 2;
+				}
 				appends[appendx].type = AP_STRING;
 				appends[appendx].s = cp->t;
 				appends[appendx].len = strlen(cp->t);
@@ -237,10 +239,12 @@ redirect:
 				flush_appends();
 				exit(0);
 			case 'r':
-				if (appendx >= appendnum)
+				if (appendx >= appendnum) {
 					appends = xrealloc(appends,
 					    sizeof(struct s_appends) *
-					    (appendnum *= 2));
+					    (appendnum * 2));
+					appendnum *= 2;
+				}
 				appends[appendx].type = AP_FILE;
 				appends[appendx].s = cp->t;
 				appends[appendx].len = strlen(cp->t);
@@ -592,8 +596,9 @@ regsub(SPACE *sp, char *string, char *src)
 
 #define	NEEDSP(reqlen)							\
 	if (sp->len + (reqlen) + 1 >= sp->blen) {			\
-		sp->blen += (reqlen) + 1024;				\
-		sp->space = sp->back = xrealloc(sp->back, sp->blen);	\
+		size_t newlen = sp->blen + (reqlen) + 1024;		\
+		sp->space = sp->back = xrealloc(sp->back, newlen);	\
+		sp->blen = newlen;					\
 		dst = sp->space + sp->len;				\
 	}
 
@@ -636,8 +641,9 @@ cspace(SPACE *sp, char *p, size_t len, enum e_spflag spflag)
 	/* Make sure SPACE has enough memory and ramp up quickly. */
 	tlen = sp->len + len + 1;
 	if (tlen > sp->blen) {
-		sp->blen = tlen + 1024;
-		sp->space = sp->back = xrealloc(sp->back, sp->blen);
+		size_t newlen = tlen + 1024;
+		sp->space = sp->back = xrealloc(sp->back, newlen);
+		sp->blen = newlen;
 	}
 
 	if (spflag == REPLACE)