From 1aa35891ad9f825415c4f5abc7bf617ebb644529 Mon Sep 17 00:00:00 2001
From: Yuichi Nishiwaki <yuichi.nishiwaki@gmail.com>
Date: Sat, 18 Jan 2014 23:01:00 +0900
Subject: [PATCH] [bugfix] must multiply the size by sizeof(struct) when using
 realloc function

---
 src/codegen.c | 6 +++---
 src/error.c   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/codegen.c b/src/codegen.c
index bc5cdbdc..d0bbd6d9 100644
--- a/src/codegen.c
+++ b/src/codegen.c
@@ -343,8 +343,8 @@ codegen(codegen_state *state, pic_value obj, bool tailpos)
 #if DEBUG
 	  puts("irep realloced");
 #endif
-	  scope->irep = (struct pic_irep **)pic_realloc(pic, scope->irep, scope->icapa * 2);
 	  scope->icapa *= 2;
+	  scope->irep = (struct pic_irep **)pic_realloc(pic, scope->irep, sizeof(struct pic_irep *) * scope->icapa);
 	}
 	k = scope->ilen++;
 	scope->code[scope->clen].insn = OP_LAMBDA;
@@ -458,8 +458,8 @@ codegen(codegen_state *state, pic_value obj, bool tailpos)
 	}
 
 	if (scope->plen >= scope->pcapa) {
-          scope->pool = (pic_value *)pic_realloc(pic, scope->pool, scope->pcapa * 2);
           scope->pcapa *= 2;
+          scope->pool = (pic_value *)pic_realloc(pic, scope->pool, sizeof(pic_value) * scope->pcapa);
 	}
 	pidx = scope->plen++;
 	scope->pool[pidx] = pic_car(pic, pic_cdr(pic, obj));
@@ -695,8 +695,8 @@ codegen(codegen_state *state, pic_value obj, bool tailpos)
   case PIC_TT_BLOB: {
     int pidx;
     if (scope->plen >= scope->pcapa) {
-      scope->pool = (pic_value *)pic_realloc(pic, scope->pool, scope->pcapa * 2);
       scope->pcapa *= 2;
+      scope->pool = (pic_value *)pic_realloc(pic, scope->pool, sizeof(pic_value) * scope->pcapa);
     }
     pidx = scope->plen++;
     scope->pool[pidx] = obj;
diff --git a/src/error.c b/src/error.c
index daf0ad69..fe23a3d7 100644
--- a/src/error.c
+++ b/src/error.c
@@ -74,8 +74,8 @@ pic_error_with_exception_handler(pic_state *pic)
     puts("rescue realloced");
 #endif
 
-    pic->rescue = (struct pic_proc **)pic_realloc(pic, pic->rescue, pic->rlen * 2);
     pic->rlen *= 2;
+    pic->rescue = (struct pic_proc **)pic_realloc(pic, pic->rescue, sizeof(struct pic_proc *) * pic->rlen);
   }
   pic->rescue[pic->ridx++] = handler;