8685b55
--- a/util.c
8685b55
+++ b/util.c
8685b55
@@ -1329,7 +1329,7 @@ void *_new_array(unsigned long num, unsigned int size, int use_calloc)
8685b55
 	return use_calloc ? calloc(num, size) : malloc(num * size);
8685b55
 }
8685b55
 
8685b55
-void *_realloc_array(void *ptr, unsigned int size, unsigned long num)
8685b55
+void *_realloc_array(void *ptr, unsigned int size, size_t num)
8685b55
 {
8685b55
 	if (num >= MALLOC_MAX/size)
8685b55
 		return NULL;
8685b55
@@ -1550,7 +1550,10 @@ void *expand_item_list(item_list *lp, size_t item_size,
8685b55
 			new_size += incr;
8685b55
 		else
8685b55
 			new_size *= 2;
8685b55
-		new_ptr = realloc_array(lp->items, char, new_size * item_size);
8685b55
+		if (new_size < lp->malloced)
8685b55
+			overflow_exit("expand_item_list");
8685b55
+		/* Using _realloc_array() lets us pass the size, not a type. */
8685b55
+		new_ptr = _realloc_array(lp->items, item_size, new_size);
8685b55
 		if (verbose >= 4) {
8685b55
 			rprintf(FINFO, "[%s] expand %s to %.0f bytes, did%s move\n",
8685b55
 				who_am_i(), desc, (double)new_size * item_size,
c0b2edb
diff -uPr rsync-2.6.9.orig/proto.h rsync-2.6.9/proto.h
c0b2edb
--- rsync-2.6.9.orig/proto.h	2008-04-08 16:44:42.000000000 -0400
c0b2edb
+++ rsync-2.6.9/proto.h	2008-04-09 10:23:52.000000000 -0400
c0b2edb
@@ -322,7 +322,7 @@
c0b2edb
 int cmp_time(time_t file1, time_t file2);
c0b2edb
 int _Insure_trap_error(int a1, int a2, int a3, int a4, int a5, int a6);
c0b2edb
 void *_new_array(unsigned int size, unsigned long num);
c0b2edb
-void *_realloc_array(void *ptr, unsigned int size, unsigned long num);
8fceedf
+void *_realloc_array(void *ptr, unsigned int size, size_t num);
c0b2edb
 const char *find_filename_suffix(const char *fn, int fn_len, int *len_ptr);
c0b2edb
 uint32 fuzzy_distance(const char *s1, int len1, const char *s2, int len2);
c0b2edb
 struct bitbag *bitbag_create(int max_ndx);