[src/trunk]: src/lib/libedit PR/42637: Joachim Kuebart: Shell tab completion ...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/6a814acbd3fe
branches:  trunk
changeset: 750915:6a814acbd3fe
user:      christos <christos%NetBSD.org@localhost>
date:      Mon Jan 18 19:17:42 2010 +0000

description:
PR/42637: Joachim Kuebart: Shell tab completion crashes due to libedit stack
smashing

diffstat:

 lib/libedit/filecomplete.c |  8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diffs (30 lines):

diff -r acef4f96f3d6 -r 6a814acbd3fe lib/libedit/filecomplete.c
--- a/lib/libedit/filecomplete.c        Mon Jan 18 19:00:58 2010 +0000
+++ b/lib/libedit/filecomplete.c        Mon Jan 18 19:17:42 2010 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: filecomplete.c,v 1.17 2009/12/30 22:37:40 christos Exp $       */
+/*     $NetBSD: filecomplete.c,v 1.18 2010/01/18 19:17:42 christos Exp $       */
 
 /*-
  * Copyright (c) 1997 The NetBSD Foundation, Inc.
@@ -31,7 +31,7 @@
 
 #include "config.h"
 #if !defined(lint) && !defined(SCCSID)
-__RCSID("$NetBSD: filecomplete.c,v 1.17 2009/12/30 22:37:40 christos Exp $");
+__RCSID("$NetBSD: filecomplete.c,v 1.18 2010/01/18 19:17:42 christos Exp $");
 #endif /* not lint && not SCCSID */
 
 #include <sys/types.h>
@@ -419,9 +419,9 @@
 
        len = li->cursor - ctemp;
 #if defined(__SSP__) || defined(__SSP_ALL__)
-       temp = malloc(len + 1);
+       temp = malloc(sizeof(*temp) * (len + 1));
 #else
-       temp = alloca(len + 1);
+       temp = alloca(sizeof(*temp) * (len + 1));
 #endif
        (void)Strncpy(temp, ctemp, len);
        temp[len] = '\0';