2011-04-10 Jim Meyering <meyering@redhat.com>

	    Avoid memory overrun in a test leading to potential double-free.
	    * testsuite/test-expandargv.c (writeout_test): Fix off-by-one error:
	    i.e., do copy the trailing NUL byte.

git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@172246 138bc75d-0d04-0410-961f-82ee72b054a4

diff --git a/libiberty/ChangeLog b/libiberty/ChangeLog
index f6138b6..a15ffa5 100644 (file)
--- a/libiberty/ChangeLog
+++ b/libiberty/ChangeLog
@@ -1,3 +1,9 @@
+2011-04-10  Jim Meyering  <meyering@redhat.com>
+
+       Avoid memory overrun in a test leading to potential double-free.
+       * testsuite/test-expandargv.c (writeout_test): Fix off-by-one error:
+       i.e., do copy the trailing NUL byte.
+
 2011-03-31  Tristan Gingold  <gingold@adacore.com>
 
        * makefile.vms (OBJS): Add filename_cmp.obj

diff --git a/libiberty/testsuite/test-expandargv.c b/libiberty/testsuite/test-expandargv.c
index c16a032..57b96b3 100644 (file)
--- a/libiberty/testsuite/test-expandargv.c
+++ b/libiberty/testsuite/test-expandargv.c
@@ -204,7 +204,7 @@ writeout_test (int test, const char * test_data)
   if (parse == NULL)
     fatal_error (__LINE__, "Failed to malloc parse.", errno);
       
-  memcpy (parse, test_data, sizeof (char) * len);
+  memcpy (parse, test_data, sizeof (char) * (len + 1));
   /* Run all possible replaces */
   run_replaces (parse);