From 21744cead978df748255ff711eebd9ddb31ed761 Mon Sep 17 00:00:00 2001 From: Ray Donnelly Date: Sun, 26 Jan 2014 14:02:26 +0000 Subject: [PATCH] output.c: Fix memory stomp when need==fmtbuf.size --- output.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/output.c b/output.c index 000e241..656fbc3 100644 --- a/output.c +++ b/output.c @@ -598,7 +598,7 @@ get_buffer (size_t need) fmtbuf.buffer = xrealloc (fmtbuf.buffer, fmtbuf.size); } - fmtbuf.buffer[need] = '\0'; + fmtbuf.buffer[need-1] = '\0'; return fmtbuf.buffer; } @@ -629,7 +629,7 @@ message (int prefix, size_t len, const char *fmt, ...) strcat (p, "\n"); - assert (fmtbuf.buffer[len] == '\0'); + assert (fmtbuf.buffer[len-1] == '\0'); outputs (0, fmtbuf.buffer); } @@ -660,7 +660,7 @@ error (const gmk_floc *flocp, size_t len, const char *fmt, ...) strcat (p, "\n"); - assert (fmtbuf.buffer[len] == '\0'); + assert (fmtbuf.buffer[len-1] == '\0'); outputs (1, fmtbuf.buffer); } @@ -692,7 +692,7 @@ fatal (const gmk_floc *flocp, size_t len, const char *fmt, ...) strcat (p, stop); - assert (fmtbuf.buffer[len] == '\0'); + assert (fmtbuf.buffer[len-1] == '\0'); outputs (1, fmtbuf.buffer); die (2); -- 1.8.5.3