Fix buffer overrun in concat().

diff --git a/ChangeLog b/ChangeLog
index 12ef1c4b494dba3aa6ae94a9a3b78b369cafaddb..a4d06007063eb42ceeb930273475738a8d9ae7eb 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2010-07-16  Boris Kolpackov  <boris@codesynthesis.com>
+
+       * misc.c (concat): Fix buffer overrun.
+
 2010-07-12  Paul Smith  <psmith@gnu.org>
 
        Update copyrights to add 2010.

diff --git a/misc.c b/misc.c
index f4806acb76d0581d36eac51b8c0e5166032a4029..39c2835e704b99edad228ee23f5d152033b3a3e8 100644 (file)
--- a/misc.c
+++ b/misc.c
@@ -202,6 +202,14 @@ concat (num, va_alist)
 
   VA_END (args);
 
+  /* Get some more memory if we don't have enough space for the
+     terminating '\0'.   */
+  if (ri == rlen)
+    {
+      rlen = (rlen ? rlen : 60) * 2;
+      result = xrealloc (result, rlen);
+    }
+
   result[ri] = '\0';
 
   return result;