From: Bruno Haible Date: Fri, 12 Apr 2019 19:56:00 +0000 (+0200) Subject: msgfmt: Fix another buffer overrun. X-Git-Tag: v0.20~56 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=be29c74ef5d161047ec7caa757a91c1470e34995;p=thirdparty%2Fgettext.git msgfmt: Fix another buffer overrun. Reported and patch by Joshua Root at . * gettext-tools/src/write-java.c (write_java_msgid): Allocate memory for the trailing NUL byte as well. * gettext-tools/src/write-csharp.c (write_csharp_msgid): Likewise. --- diff --git a/gettext-tools/src/write-csharp.c b/gettext-tools/src/write-csharp.c index 31d6f1212..52e32d8e2 100644 --- a/gettext-tools/src/write-csharp.c +++ b/gettext-tools/src/write-csharp.c @@ -1,5 +1,5 @@ /* Writing C# satellite assemblies. - Copyright (C) 2003-2010, 2016, 2018 Free Software Foundation, Inc. + Copyright (C) 2003-2010, 2016, 2018-2019 Free Software Foundation, Inc. Written by Bruno Haible , 2003. This program is free software: you can redistribute it and/or modify @@ -234,7 +234,7 @@ write_csharp_msgid (FILE *stream, message_ty *mp) size_t combined_len = msgctxt_len + 1 + msgid_len; char *combined; - combined = (char *) xmalloca (combined_len); + combined = (char *) xmalloca (combined_len + 1); memcpy (combined, msgctxt, msgctxt_len); combined[msgctxt_len] = MSGCTXT_SEPARATOR; memcpy (combined + msgctxt_len + 1, msgid, msgid_len + 1); diff --git a/gettext-tools/src/write-java.c b/gettext-tools/src/write-java.c index 08ff853bb..68e0e3a73 100644 --- a/gettext-tools/src/write-java.c +++ b/gettext-tools/src/write-java.c @@ -417,7 +417,7 @@ write_java_msgid (FILE *stream, message_ty *mp) size_t combined_len = msgctxt_len + 1 + msgid_len; char *combined; - combined = (char *) xmalloca (combined_len); + combined = (char *) xmalloca (combined_len + 1); memcpy (combined, msgctxt, msgctxt_len); combined[msgctxt_len] = MSGCTXT_SEPARATOR; memcpy (combined + msgctxt_len + 1, msgid, msgid_len + 1);