When the buffer gets realloced to hold the file name in the
SSH_SFTP_READDIR_LINK state, the counter was not bumped accordingly.
Reported by: Armel Asselin
Patch by: Armel Asselin
Bug: http://curl.haxx.se/mail/lib-2011-12/0249.html
Curl_safefree(sshc->readdir_linkPath);
sshc->readdir_linkPath = NULL;
- new_readdir_line = realloc(sshc->readdir_line,
- sshc->readdir_totalLen + 4 +
- sshc->readdir_len);
+ /* get room for the filename and extra output */
+ sshc->readdir_totalLen += 4 + sshc->readdir_len:
+ new_readdir_line = realloc(sshc->readdir_line, sshc->readdir_totalLen);
if(!new_readdir_line) {
Curl_safefree(sshc->readdir_line);
sshc->readdir_line = NULL;