libmp: Fix trivial buffer overrun

fgetln yields a non-NUL-terminated buffer and its length.  This routine
attempted to NUL-terminate it, but did not allocate space for the NUL.  So,
allocate space for the NUL.

Reported by:	Coverity
CID:		1017457
Sponsored by:	EMC / Isilon Storage Division
This commit is contained in:
Conrad Meyer 2016-05-12 03:53:20 +00:00
parent 1d1694a73b
commit d0725e2250
Notes: svn2git 2020-12-20 02:59:44 +00:00
svn path=/head/; revision=299510

View file

@ -286,10 +286,10 @@ mp_min(MINT *mp)
line = fgetln(stdin, &linelen);
if (line == NULL)
MPERR(("min"));
nline = malloc(linelen);
nline = malloc(linelen + 1);
if (nline == NULL)
MPERR(("min"));
strncpy(nline, line, linelen);
memcpy(nline, line, linelen);
nline[linelen] = '\0';
rmp = _dtom("min", nline);
_movem("min", rmp, mp);