1 files changed, 24 insertions, 14 deletions

diff --git a/mdk-stage1/dietlibc/librpc/xdr_array.c b/mdk-stage1/dietlibc/librpc/xdr_array.c
index f8ae12b19..f0c9bbbb3 100644
--- a/mdk-stage1/dietlibc/librpc/xdr_array.c
+++ b/mdk-stage1/dietlibc/librpc/xdr_array.c
@@ -48,7 +48,7 @@ static char sccsid[] =
 #include <rpc/xdr.h>
 #include <string.h>
 
-#define LASTUNSIGNED	((u_int)0-1)
+#define LASTUNSIGNED	((unsigned int)0-1)
 
 
 /*
@@ -60,17 +60,17 @@ static char sccsid[] =
  */
 bool_t xdr_array(xdrs, addrp, sizep, maxsize, elsize, elproc)
 register XDR *xdrs;
-caddr_t *addrp;					/* array pointer */
-u_int *sizep;					/* number of elements */
-u_int maxsize;					/* max numberof elements */
-u_int elsize;					/* size in bytes of each element */
+char* *addrp;					/* array pointer */
+unsigned int *sizep;					/* number of elements */
+unsigned int maxsize;					/* max numberof elements */
+unsigned int elsize;					/* size in bytes of each element */
 xdrproc_t elproc;				/* xdr routine to handle each element */
 {
-	register u_int i;
-	register caddr_t target = *addrp;
-	register u_int c;			/* the actual element count */
+	register unsigned int i;
+	register char* target = *addrp;
+	register unsigned int c;			/* the actual element count */
 	register bool_t stat = TRUE;
-	register u_int nodesize;
+	register unsigned int nodesize;
 
 	/* like strings, arrays are really counted arrays */
 	if (!xdr_u_int(xdrs, sizep)) {
@@ -80,7 +80,17 @@ xdrproc_t elproc;				/* xdr routine to handle each element */
 	if ((c > maxsize) && (xdrs->x_op != XDR_FREE)) {
 		return (FALSE);
 	}
-	nodesize = c * elsize;
+	/* duh, look for integer overflow (fefe) */
+	{
+	  unsigned int i;
+	  nodesize = 0;
+	  for (i=c; i; --i) {
+	    unsigned int tmp=nodesize+elsize;
+	    if (tmp<nodesize)	/* overflow */
+	      return FALSE;
+	    nodesize=tmp;
+	  }
+	}
 
 	/*
 	 * if we are deserializing, we may need to allocate an array.
@@ -96,7 +106,7 @@ xdrproc_t elproc;				/* xdr routine to handle each element */
 				(void) fprintf(stderr, "xdr_array: out of memory\n");
 				return (FALSE);
 			}
-			bzero(target, nodesize);
+			memset(target, 0, nodesize);
 			break;
 
 		case XDR_FREE:
@@ -134,11 +144,11 @@ xdrproc_t elproc;				/* xdr routine to handle each element */
 bool_t xdr_vector(xdrs, basep, nelem, elemsize, xdr_elem)
 register XDR *xdrs;
 register char *basep;
-register u_int nelem;
-register u_int elemsize;
+register unsigned int nelem;
+register unsigned int elemsize;
 register xdrproc_t xdr_elem;
 {
-	register u_int i;
+	register unsigned int i;
 	register char *elptr;
 
 	elptr = basep;