MFC misc.c 1.1.1.5 (->scp.c):

Correct more cases of allocation size bookkeeping errors.
(This file was previously missed during the mergeathon.)

1 files changed, 7 insertions, 4 deletions

diff --git a/crypto/openssh/scp.c b/crypto/openssh/scp.c
index 81d3b55b9622..d844be36de2b 100644
--- a/crypto/openssh/scp.c
+++ b/crypto/openssh/scp.c
@@ -1174,18 +1174,21 @@ addargs(char *fmt, ...)
 {
 	va_list ap;
 	char buf[1024];
+	int nalloc;
 
 	va_start(ap, fmt);
 	vsnprintf(buf, sizeof(buf), fmt, ap);
 	va_end(ap);
 
 	if (args.list == NULL) {
-		args.nalloc = 32;
+		nalloc = 32;
 		args.num = 0;
-		args.list = xmalloc(args.nalloc * sizeof(char *));
+		args.list = xmalloc(nalloc * sizeof(char *));
+		args.nalloc = nalloc;
 	} else if (args.num+2 >= args.nalloc) {
-		args.nalloc *= 2;
-		args.list = xrealloc(args.list, args.nalloc * sizeof(char *));
+		nalloc = args.nalloc * 2;
+		args.list = xrealloc(args.list, nalloc * sizeof(char *));
+		args.nalloc = nalloc;
 	}
 	args.list[args.num++] = xstrdup(buf);
 	args.list[args.num] = NULL;