(canonicalize_file_name) [!HAVE_RESOLVEPATH]:

A memory-allocation error could result in heap corruption.  Fix it
by also updating `dest' when rpath may be changed by xrealloc.

diff --git a/lib/canonicalize.c b/lib/canonicalize.c
index 453279d3ca292a9f5a88a170db11166c7ab08fb1..6e58b282dd4cba63bf7c112ebf6c53e23611df04 100644 (file)
--- a/lib/canonicalize.c
+++ b/lib/canonicalize.c
@@ -173,9 +173,11 @@ canonicalize_file_name (const char *name)
       if (!rpath)
        return NULL;
       dest = strchr (rpath, '\0');
-      if (dest < rpath + PATH_MAX)
+      if (dest - rpath < PATH_MAX)
        {
-         rpath = xrealloc (rpath, PATH_MAX);
+         char *p = xrealloc (rpath, PATH_MAX);
+         dest = p + (dest - rpath);
+         rpath = p;
          rpath_limit = rpath + PATH_MAX;
        }
       else