* libltdl/ltdl.c (trim): Fix possible write beyond array bound.

diff --git a/ChangeLog b/ChangeLog
index 998c0d5d44643c9d6f439f05c5aecb94d7b774e7..eb9e2d3bacfa6664be183ebad03352a64f359aa0 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 2007-09-01  Ralf Wildenhues  <Ralf.Wildenhues@gmx.de>
 
+       * libltdl/ltdl.c (trim): Fix possible write beyond array bound.
+
        * libltdl/ltdl.c (try_dlopen): Do not test array address of
        sys_dlsearch_path against NULL, rather test for nonempty
        contents.

diff --git a/libltdl/ltdl.c b/libltdl/ltdl.c
index 5135fbe24c65d207d826273bec1ab6cf9ce78f9a..a83a02c6d460ed5270312eb487802a99ccb17a54 100644 (file)
--- a/libltdl/ltdl.c
+++ b/libltdl/ltdl.c
@@ -3043,7 +3043,7 @@ trim (dest, str)
        return 1;
 
       strncpy(tmp, &str[1], (end - str) - 1);
-      tmp[len-3] = LT_EOS_CHAR;
+      tmp[(end - str) - 1] = LT_EOS_CHAR;
       *dest = tmp;
     }
   else