Use safer sizeof variant in malloc

For a local variable:
        TYPE *p;
Allocations like this are "risky":
        p = OPENSSL_malloc(sizeof(TYPE));
if the type of p changes, and the malloc call isn't updated, you
could get memory corruption.  Instead do this:
        p = OPENSSL_malloc(sizeof(*p));
Also fixed a few memset() calls that I noticed while doing this.

Reviewed-by: Richard Levitte <levitte@openssl.org>

12 files changed, 27 insertions, 31 deletions

diff --git a/ssl/bio_ssl.c b/ssl/bio_ssl.c
index 284d3ad133..18e70747b3 100644
--- a/ssl/bio_ssl.c
+++ b/ssl/bio_ssl.c
@@ -101,9 +101,8 @@ BIO_METHOD *BIO_f_ssl(void)
 
 static int ssl_new(BIO *bi)
 {
-    BIO_SSL *bs;
+    BIO_SSL *bs = OPENSSL_malloc(sizeof(*bs));
 
-    bs = OPENSSL_malloc(sizeof(BIO_SSL));
     if (bs == NULL) {
         BIOerr(BIO_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
         return (0);
diff --git a/ssl/d1_both.c b/ssl/d1_both.c
index 3af3ba15cc..65a3a18bc4 100644
--- a/ssl/d1_both.c
+++ b/ssl/d1_both.c
@@ -170,7 +170,7 @@ static hm_fragment *dtls1_hm_fragment_new(unsigned long frag_len,
     unsigned char *buf = NULL;
     unsigned char *bitmask = NULL;
 
-    frag = OPENSSL_malloc(sizeof(hm_fragment));
+    frag = OPENSSL_malloc(sizeof(*frag));
     if (frag == NULL)
         return NULL;
 
diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 81d532c277..3441fc56e0 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -136,11 +136,11 @@ int dtls1_new(SSL *s)
     
     if (!ssl3_new(s))
         return (0);
-    if ((d1 = OPENSSL_malloc(sizeof *d1)) == NULL) {
+    if ((d1 = OPENSSL_malloc(sizeof(*d1))) == NULL) {
         ssl3_free(s);
         return (0);
     }
-    memset(d1, 0, sizeof *d1);
+    memset(d1, 0, sizeof(*d1));
 
     d1->buffered_messages = pqueue_new();
     d1->sent_messages = pqueue_new();
diff --git a/ssl/record/rec_layer_d1.c b/ssl/record/rec_layer_d1.c
index a484c97bb5..2635894ed3 100644
--- a/ssl/record/rec_layer_d1.c
+++ b/ssl/record/rec_layer_d1.c
@@ -127,9 +127,8 @@ int DTLS_RECORD_LAYER_new(RECORD_LAYER *rl)
 {
     DTLS_RECORD_LAYER *d;
     
-    if ((d = OPENSSL_malloc(sizeof *d)) == NULL) {
+    if ((d = OPENSSL_malloc(sizeof(*d))) == NULL)
         return (0);
-    }
 
 
     rl->d = d;
@@ -196,7 +195,7 @@ void DTLS_RECORD_LAYER_clear(RECORD_LAYER *rl)
     unprocessed_rcds = d->unprocessed_rcds.q;
     processed_rcds = d->processed_rcds.q;
     buffered_app_data = d->buffered_app_data.q;
-    memset(d, 0, sizeof *d);
+    memset(d, 0, sizeof(*d));
     d->unprocessed_rcds.q = unprocessed_rcds;
     d->processed_rcds.q = processed_rcds;
     d->buffered_app_data.q = buffered_app_data;
@@ -259,7 +258,7 @@ int dtls1_buffer_record(SSL *s, record_pqueue *queue, unsigned char *priority)
     if (pqueue_size(queue->q) >= 100)
         return 0;
 
-    rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
+    rdata = OPENSSL_malloc(sizeof(*rdata));
     item = pitem_new(priority, rdata);
     if (rdata == NULL || item == NULL) {
         OPENSSL_free(rdata);
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 45de404894..d968a1c04b 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -244,7 +244,7 @@ int ssl3_change_cipher_state(SSL *s, int which)
         if (s->enc_read_ctx != NULL)
             reuse_dd = 1;
         else if ((s->enc_read_ctx =
-                  OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
+                  OPENSSL_malloc(sizeof(*s->enc_read_ctx))) == NULL)
             goto err;
         else
             /*
@@ -278,7 +278,7 @@ int ssl3_change_cipher_state(SSL *s, int which)
         if (s->enc_write_ctx != NULL)
             reuse_dd = 1;
         else if ((s->enc_write_ctx =
-                  OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
+                  OPENSSL_malloc(sizeof(*s->enc_write_ctx))) == NULL)
             goto err;
         else
             /*
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index e346c22eb3..a962b5cb63 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -3098,9 +3098,9 @@ int ssl3_new(SSL *s)
 {
     SSL3_STATE *s3;
 
-    if ((s3 = OPENSSL_malloc(sizeof *s3)) == NULL)
+    if ((s3 = OPENSSL_malloc(sizeof(*s3))) == NULL)
         goto err;
-    memset(s3, 0, sizeof *s3);
+    memset(s3, 0, sizeof(*s3));
     s->s3 = s3;
     
 #ifndef OPENSSL_NO_SRP
@@ -3137,7 +3137,7 @@ void ssl3_free(SSL *s)
 #ifndef OPENSSL_NO_SRP
     SSL_SRP_CTX_free(s);
 #endif
-    OPENSSL_clear_free(s->s3, sizeof *s->s3);
+    OPENSSL_clear_free(s->s3, sizeof(*s->s3));
     s->s3 = NULL;
 }
 
@@ -3174,7 +3174,7 @@ void ssl3_clear(SSL *s)
         s->s3->alpn_selected = NULL;
     }
 #endif
-    memset(s->s3, 0, sizeof *s->s3);
+    memset(s->s3, 0, sizeof(*s->s3));
     s->s3->init_extra = init_extra;
 
     ssl_free_wbio_buffer(s);
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index cce7f15b61..c7a2aa9957 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -182,9 +182,8 @@ void ssl_cert_set_default_md(CERT *cert)
 
 CERT *ssl_cert_new(void)
 {
-    CERT *ret;
+    CERT *ret = OPENSSL_malloc(sizeof(*ret));
 
-    ret = OPENSSL_malloc(sizeof(CERT));
     if (ret == NULL) {
         SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE);
         return (NULL);
@@ -202,10 +201,9 @@ CERT *ssl_cert_new(void)
 
 CERT *ssl_cert_dup(CERT *cert)
 {
-    CERT *ret;
+    CERT *ret = OPENSSL_malloc(sizeof(*ret));
     int i;
 
-    ret = OPENSSL_malloc(sizeof(CERT));
     if (ret == NULL) {
         SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
         return (NULL);
@@ -577,13 +575,13 @@ SESS_CERT *ssl_sess_cert_new(void)
 {
     SESS_CERT *ret;
 
-    ret = OPENSSL_malloc(sizeof *ret);
+    ret = OPENSSL_malloc(sizeof(*ret));
     if (ret == NULL) {
         SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
         return NULL;
     }
 
-    memset(ret, 0, sizeof *ret);
+    memset(ret, 0, sizeof(*ret));
     ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
     ret->references = 1;
 
diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index a3dca18ad2..0ddb56bb39 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -499,7 +499,7 @@ static void load_builtin_compressions(void)
             MemCheck_off();
             ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);
             if (ssl_comp_methods != NULL) {
-                comp = OPENSSL_malloc(sizeof(SSL_COMP));
+                comp = OPENSSL_malloc(sizeof(*comp));
                 if (comp != NULL) {
                     comp->method = COMP_zlib();
                     if (comp->method && comp->method->type == NID_undef)
@@ -1452,7 +1452,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK
     fprintf(stderr, "ssl_create_cipher_list() for %d ciphers\n",
             num_of_ciphers);
 #endif                          /* KSSL_DEBUG */
-    co_list = OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
+    co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers);
     if (co_list == NULL) {
         SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
         return (NULL);          /* Failure */
@@ -1533,7 +1533,7 @@ STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK
      */
     num_of_group_aliases = OSSL_NELEM(cipher_aliases);
     num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
-    ca_list = OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
+    ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max);
     if (ca_list == NULL) {
         OPENSSL_free(co_list);
         SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
@@ -1933,7 +1933,7 @@ int SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
     }
 
     MemCheck_off();
-    comp = OPENSSL_malloc(sizeof(SSL_COMP));
+    comp = OPENSSL_malloc(sizeof(*comp));
     if (comp == NULL) {
         MemCheck_on();
         SSLerr(SSL_F_SSL_COMP_ADD_COMPRESSION_METHOD, ERR_R_MALLOC_FAILURE);
diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c
index 2d96b11995..a14f564f24 100644
--- a/ssl/ssl_conf.c
+++ b/ssl/ssl_conf.c
@@ -609,9 +609,9 @@ int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd)
 
 SSL_CONF_CTX *SSL_CONF_CTX_new(void)
 {
-    SSL_CONF_CTX *ret;
+    SSL_CONF_CTX *ret = OPENSSL_malloc(sizeof(*ret));
     size_t i;
-    ret = OPENSSL_malloc(sizeof(SSL_CONF_CTX));
+
     if (ret) {
         ret->flags = 0;
         ret->prefix = NULL;
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 4dfd7ab7f0..56d7e6c55a 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -272,7 +272,7 @@ SSL *SSL_new(SSL_CTX *ctx)
         return (NULL);
     }
 
-    s = OPENSSL_malloc(sizeof(SSL));
+    s = OPENSSL_malloc(sizeof(*s));
     if (s == NULL)
         goto err;
     memset(s, 0, sizeof(SSL));
@@ -1844,7 +1844,7 @@ SSL_CTX *SSL_CTX_new(const SSL_METHOD *meth)
         SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
         goto err;
     }
-    ret = OPENSSL_malloc(sizeof(SSL_CTX));
+    ret = OPENSSL_malloc(sizeof(*ret));
     if (ret == NULL)
         goto err;
 
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 1a00c38882..b592da4dae 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -193,7 +193,7 @@ SSL_SESSION *SSL_SESSION_new(void)
 {
     SSL_SESSION *ss;
 
-    ss = OPENSSL_malloc(sizeof(SSL_SESSION));
+    ss = OPENSSL_malloc(sizeof(*ss));
     if (ss == NULL) {
         SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE);
         return (0);
diff --git a/ssl/t1_enc.c b/ssl/t1_enc.c
index 5c7fb86a70..47bab9985b 100644
--- a/ssl/t1_enc.c
+++ b/ssl/t1_enc.c
@@ -375,7 +375,7 @@ int tls1_change_cipher_state(SSL *s, int which)
         if (s->enc_read_ctx != NULL)
             reuse_dd = 1;
         else if ((s->enc_read_ctx =
-                  OPENSSL_malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
+                  OPENSSL_malloc(sizeof(*s->enc_read_ctx))) == NULL)
             goto err;
         else
             /*