Avoid memory overrun in a test leading to potential double-free.

2011-04-10  Jim Meyering  <meyering@redhat.com>

	    Avoid memory overrun in a test leading to potential double-free.
	    * testsuite/test-expandargv.c (writeout_test): Fix off-by-one error:
	    i.e., do copy the trailing NUL byte.

From-SVN: r172246

diff --git a/libiberty/ChangeLog b/libiberty/ChangeLog
index f6138b69e2482567213aa834738afc2bbc83bd18..a15ffa59d2891af788597a9f561d242333f0357b 100644 (file)
--- a/libiberty/ChangeLog
+++ b/libiberty/ChangeLog
@@ -1,3 +1,9 @@
+2011-04-10  Jim Meyering  <meyering@redhat.com>
+
+       Avoid memory overrun in a test leading to potential double-free.
+       * testsuite/test-expandargv.c (writeout_test): Fix off-by-one error:
+       i.e., do copy the trailing NUL byte.
+
 2011-03-31  Tristan Gingold  <gingold@adacore.com>
 
        * makefile.vms (OBJS): Add filename_cmp.obj

diff --git a/libiberty/testsuite/test-expandargv.c b/libiberty/testsuite/test-expandargv.c
index c16a0322a6c4b20ba77604f686e7cfd38a225d95..57b96b3ff9773ec4c53df925d77b29740ec7a946 100644 (file)
--- a/libiberty/testsuite/test-expandargv.c
+++ b/libiberty/testsuite/test-expandargv.c
@@ -204,7 +204,7 @@ writeout_test (int test, const char * test_data)
   if (parse == NULL)
     fatal_error (__LINE__, "Failed to malloc parse.", errno);
       
-  memcpy (parse, test_data, sizeof (char) * len);
+  memcpy (parse, test_data, sizeof (char) * (len + 1));
   /* Run all possible replaces */
   run_replaces (parse);