MFC r299510:

r299510 (by cem):

libmp: Fix trivial buffer overrun

fgetln yields a non-NUL-terminated buffer and its length.  This routine
attempted to NUL-terminate it, but did not allocate space for the NUL.  So,
allocate space for the NUL.

CID:		1017457
This commit is contained in:
Enji Cooper 2016-06-10 18:10:32 +00:00
parent 629dae7e20
commit 96c1cc6c19
Notes: svn2git 2020-12-20 02:59:44 +00:00
svn path=/stable/10/; revision=301806

View File

@ -286,10 +286,10 @@ mp_min(MINT *mp)
line = fgetln(stdin, &linelen);
if (line == NULL)
MPERR(("min"));
nline = malloc(linelen);
nline = malloc(linelen + 1);
if (nline == NULL)
MPERR(("min"));
strncpy(nline, line, linelen);
memcpy(nline, line, linelen);
nline[linelen] = '\0';
rmp = _dtom("min", nline);
_movem("min", rmp, mp);