(_dl_init_paths): Add one more element to aelem to not write beyond allocated

memory.

diff --git a/elf/dl-load.c b/elf/dl-load.c
index 5ed5128ef577eb68d886b20fbbd2f0ba5f60114e..a0448e9091d3a91b15b08be346e6762e181cf71a 100644 (file)
--- a/elf/dl-load.c
+++ b/elf/dl-load.c
@@ -513,7 +513,7 @@ _dl_init_paths (const char *llp)
 
   /* First set up the rest of the default search directory entries.  */
   aelem = rtld_search_dirs = (struct r_search_path_elem **)
-    malloc ((sizeof (system_dirs_len) / sizeof (system_dirs_len[0]))
+    malloc ((sizeof (system_dirs_len) / sizeof (system_dirs_len[0]) + 1)
             * sizeof (struct r_search_path_elem *));
   if (rtld_search_dirs == NULL)
     _dl_signal_error (ENOMEM, NULL, "cannot create search path array");