more: fix buffer overflow

The bug has been probably introduced by commit
1ac300932deab8dea2c43050921bbbdb36d62ff1.

Reported-by: "Dr. David Alan Gilbert" <dave@treblig.org>
References: https://bugzilla.novell.com/show_bug.cgi?id=829720
Signed-off-by: Karel Zak <kzak@redhat.com>

diff --git a/text-utils/more.c b/text-utils/more.c
index 3bbeede5d97409f0cfb4204332a1875a64d40436..33771183c67cae06b7ce4c1620be07cbc6f59d5d 100644 (file)
--- a/text-utils/more.c
+++ b/text-utils/more.c
@@ -835,7 +835,8 @@ void prepare_line_buffer(void)
        if (nsz < LINSIZ)
                nsz = LINSIZ;
 
-       nline = xrealloc(Line, nsz);
+       /* alloc nsz and extra space for \n\0 */
+       nline = xrealloc(Line, nsz + 2);
        Line = nline;
        LineLen = nsz;
 }