===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/cvs/rcsnum.c,v
retrieving revision 1.29
retrieving revision 1.30
diff -c -r1.29 -r1.30
*** src/usr.bin/cvs/rcsnum.c	2006/03/28 02:13:44	1.29
--- src/usr.bin/cvs/rcsnum.c	2006/03/30 06:07:35	1.30
***************
*** 1,4 ****
! /*	$OpenBSD: rcsnum.c,v 1.29 2006/03/28 02:13:44 ray Exp $	*/
  /*
   * Copyright (c) 2004 Jean-Francois Brousseau <jfb@openbsd.org>
   * All rights reserved.
--- 1,4 ----
! /*	$OpenBSD: rcsnum.c,v 1.30 2006/03/30 06:07:35 ray Exp $	*/
  /*
   * Copyright (c) 2004 Jean-Francois Brousseau <jfb@openbsd.org>
   * All rights reserved.
***************
*** 38,45 ****
  /*
   * rcsnum_alloc()
   *
!  * Allocate an RCS number structure and return a pointer to it on success,
!  * or NULL on failure.
   */
  RCSNUM *
  rcsnum_alloc(void)
--- 38,44 ----
  /*
   * rcsnum_alloc()
   *
!  * Allocate an RCS number structure and return a pointer to it.
   */
  RCSNUM *
  rcsnum_alloc(void)
***************
*** 141,166 ****
   * rcsnum_cpy()
   *
   * Copy the number stored in <nsrc> in the destination <ndst> up to <depth>
!  * numbers deep.
!  * Returns 0 on success, or -1 on failure.
   */
! int
  rcsnum_cpy(const RCSNUM *nsrc, RCSNUM *ndst, u_int depth)
  {
  	u_int len;
- 	size_t sz;
  	void *tmp;
  
  	len = nsrc->rn_len;
  	if ((depth != 0) && (len > depth))
  		len = depth;
- 	sz = len * sizeof(u_int16_t);
  
! 	tmp = xrealloc(ndst->rn_id, 1, sz);
  	ndst->rn_id = (u_int16_t *)tmp;
  	ndst->rn_len = len;
! 	memcpy(ndst->rn_id, nsrc->rn_id, sz);
! 	return (0);
  }
  
  /*
--- 140,162 ----
   * rcsnum_cpy()
   *
   * Copy the number stored in <nsrc> in the destination <ndst> up to <depth>
!  * numbers deep.  If <depth> is 0, there is no depth limit.
   */
! void
  rcsnum_cpy(const RCSNUM *nsrc, RCSNUM *ndst, u_int depth)
  {
  	u_int len;
  	void *tmp;
  
  	len = nsrc->rn_len;
  	if ((depth != 0) && (len > depth))
  		len = depth;
  
! 	tmp = xrealloc(ndst->rn_id, len, sizeof(len));
  	ndst->rn_id = (u_int16_t *)tmp;
  	ndst->rn_len = len;
! 	/* Overflow checked in xrealloc(). */
! 	memcpy(ndst->rn_id, nsrc->rn_id, len * sizeof(len));
  }
  
  /*