Solve buffer overflow on tab completion in ash

This commit is contained in:
Erik van der Kouwe 2010-08-23 16:30:58 +00:00
parent c9d500e9fd
commit d743c5c6f3

View file

@ -188,7 +188,7 @@ rl_complete(pathname, unique)
if (ac == 1) { if (ac == 1) {
/* Exactly one match -- finish it off. */ /* Exactly one match -- finish it off. */
*unique = 1; *unique = 1;
j = strlen(av[0]) - len + 2; j = strlen(av[0]) - len + 1;
if ((p = NEW(char, j + 1)) != NULL) { if ((p = NEW(char, j + 1)) != NULL) {
COPYFROMTO(p, av[0] + len, j); COPYFROMTO(p, av[0] + len, j);
if ((new = NEW(char, strlen(dir) + strlen(av[0]) + 2)) != NULL) { if ((new = NEW(char, strlen(dir) + strlen(av[0]) + 2)) != NULL) {