msgfmt: Fix another buffer overrun.

Reported and patch by Joshua Root <jmr@macports.org>
at <https://savannah.gnu.org/bugs/?56126>.

* gettext-tools/src/write-java.c (write_java_msgid): Allocate memory for the
trailing NUL byte as well.
* gettext-tools/src/write-csharp.c (write_csharp_msgid): Likewise.

diff --git a/gettext-tools/src/write-csharp.c b/gettext-tools/src/write-csharp.c
index 31d6f1212be5d309d61c188bbe7491700418dff4..52e32d8e2a09dd6e9fa31a1c2a2a7a66425658a1 100644 (file)
--- a/gettext-tools/src/write-csharp.c
+++ b/gettext-tools/src/write-csharp.c
@@ -1,5 +1,5 @@
 /* Writing C# satellite assemblies.
-   Copyright (C) 2003-2010, 2016, 2018 Free Software Foundation, Inc.
+   Copyright (C) 2003-2010, 2016, 2018-2019 Free Software Foundation, Inc.
    Written by Bruno Haible <bruno@clisp.org>, 2003.
 
    This program is free software: you can redistribute it and/or modify
@@ -234,7 +234,7 @@ write_csharp_msgid (FILE *stream, message_ty *mp)
       size_t combined_len = msgctxt_len + 1 + msgid_len;
       char *combined;
 
-      combined = (char *) xmalloca (combined_len);
+      combined = (char *) xmalloca (combined_len + 1);
       memcpy (combined, msgctxt, msgctxt_len);
       combined[msgctxt_len] = MSGCTXT_SEPARATOR;
       memcpy (combined + msgctxt_len + 1, msgid, msgid_len + 1);

diff --git a/gettext-tools/src/write-java.c b/gettext-tools/src/write-java.c
index 08ff853bb687191f3119d1f91c2de0487ea22b0a..68e0e3a732145b3c0d1d549968fa94f29d797669 100644 (file)
--- a/gettext-tools/src/write-java.c
+++ b/gettext-tools/src/write-java.c
@@ -417,7 +417,7 @@ write_java_msgid (FILE *stream, message_ty *mp)
       size_t combined_len = msgctxt_len + 1 + msgid_len;
       char *combined;
 
-      combined = (char *) xmalloca (combined_len);
+      combined = (char *) xmalloca (combined_len + 1);
       memcpy (combined, msgctxt, msgctxt_len);
       combined[msgctxt_len] = MSGCTXT_SEPARATOR;
       memcpy (combined + msgctxt_len + 1, msgid, msgid_len + 1);