mirror of
https://github.com/moparisthebest/curl
synced 2024-08-13 17:03:50 -04:00
Prevent an off-by-one in a allocated buffer in glob_match_url() - detected by
coverity.com
This commit is contained in:
parent
18be9882f7
commit
6c2167b65f
@ -496,7 +496,8 @@ char *glob_match_url(char *filename, URLGlob *glob)
|
|||||||
* be longer than the URL we use. We allocate a good start size, then
|
* be longer than the URL we use. We allocate a good start size, then
|
||||||
* we need to realloc in case of need.
|
* we need to realloc in case of need.
|
||||||
*/
|
*/
|
||||||
allocsize=strlen(filename);
|
allocsize=strlen(filename)+1; /* make it at least one byte to store the
|
||||||
|
trailing zero */
|
||||||
target = malloc(allocsize);
|
target = malloc(allocsize);
|
||||||
if(NULL == target)
|
if(NULL == target)
|
||||||
return NULL; /* major failure */
|
return NULL; /* major failure */
|
||||||
@ -548,7 +549,9 @@ char *glob_match_url(char *filename, URLGlob *glob)
|
|||||||
}
|
}
|
||||||
if(appendlen + stringlen >= allocsize) {
|
if(appendlen + stringlen >= allocsize) {
|
||||||
char *newstr;
|
char *newstr;
|
||||||
allocsize = (appendlen + stringlen)*2;
|
/* we append a single byte to allow for the trailing byte to be appended
|
||||||
|
at the end of this function outside the while() loop */
|
||||||
|
allocsize = (appendlen + stringlen)*2 + 1;
|
||||||
newstr=realloc(target, allocsize);
|
newstr=realloc(target, allocsize);
|
||||||
if(NULL ==newstr) {
|
if(NULL ==newstr) {
|
||||||
free(target);
|
free(target);
|
||||||
|
Loading…
Reference in New Issue
Block a user