Allow space for trailing NULL (closes: #897712)

cfname was previously STRSZ long, but the strncat use on l661 could
write up to STRSZ bytes to it, which would mean that the trailing NULL
would then overflow the array. Fix this by allocating STRSZ+1 bytes to
cfname.

diff --git a/tsl.c b/tsl.c
index f6d90b20ec6fb6cc65325ccf8ad5b452e32e79d6..d5946a2129c0268406f71089645dbf1bf2f20fd6 100644 (file)
--- a/tsl.c
+++ b/tsl.c
@@ -595,7 +595,7 @@ void tsl_init(char *dfname,char *path, const int memlimit)
     Univ_Int *up;
     int tablesize;
 #define STRSZ 255
-    char cfname[STRSZ];
+    char cfname[STRSZ+1]; /*allow space for trailing NULL*/
 
     if (memlimit > 0)
        tsl_maxbuffusage = memlimit<<10;        /* times 1024 */