buffer length calculation changes

diff --git a/filter.c b/filter.c
index 9a18975faff485c6bdf25fe9cb67a7da746839a1..5fdec626f45954e0d364e085c1a9337db0641feb 100644 (file)
--- a/filter.c
+++ b/filter.c
@@ -140,7 +140,7 @@ get_real_name()
 
        pwent = getpwnam(username);
 
-       if( (tmp = (char *)malloc(strlen(pwent->pw_gecos) +1)) == NULL)
+       if((tmp = strdup(pwent->pw_gecos)) == NULL)
                return strdup(username);
 
        rtn = sscanf(pwent->pw_gecos, "%[^,]", tmp);
@@ -640,15 +640,15 @@ mutt_read_line(FILE *in, char **alias, char **rest)
        while( ! ISSPACE(*ptr) )
                ptr++;
 
-       if( (*alias = (char *)malloc(ptr-tmp+1)) == NULL) {
+       if( (*alias = (char *)malloc(ptr - tmp)) == NULL) {
                free(line);
                return 1;
        }
 
-       strncpy(*alias, tmp, ptr-tmp);
+       strncpy(*alias, tmp, ptr - tmp - 1);
        *(*alias + (ptr - tmp)) = 0;
 
-       while( ISSPACE(*ptr) )
+       while(ISSPACE(*ptr))
                ptr++;
 
        *rest = strdup(ptr);    

diff --git a/ldif.c b/ldif.c
index 46230ad6af853dfa93610349188a4f317ace46b3..617cefceaca0ea6da9ae178dbfcb9d4578f10899 100644 (file)
--- a/ldif.c
+++ b/ldif.c
@@ -327,10 +327,16 @@ ldif_type_and_value( char *type, char *val, int vlen )
 {
     char       *buf, *p;
     int                tlen;
+    size_t     bufsize, t;
 
     tlen = strlen( type );
-    if (( buf = (char *)malloc( LDIF_SIZE_NEEDED( tlen, vlen ) + 1 )) !=
-           NULL ) {
+
+    t = LDIF_SIZE_NEEDED( tlen, vlen );
+    if((bufsize = t + 1) <= t)
+        return NULL;
+
+    if (( buf = (char *)malloc( bufsize )) == NULL ) {
+       return NULL;
     }
 
     p = buf;

diff --git a/misc.c b/misc.c
index fa67f0c99a644942f26c2b43af43ca3f85282370..8a4b9cfc5d2657fbb8ed69076c849d88b1efa5f6 100644 (file)
--- a/misc.c
+++ b/misc.c
@@ -123,7 +123,7 @@ mkstr (const char *format, ... )
 char*
 strconcat (const char *str, ...)
 {
-       int   l;
+       unsigned long l;
        MY_VA_LOCAL_DECL;
        char *s, *concat;
 
@@ -144,6 +144,8 @@ strconcat (const char *str, ...)
 #else
        malloc(l);
 #endif
+       if(concat == NULL)
+               return NULL;
 
        strcpy (concat, str);
        MY_VA_START(str);
@@ -190,6 +192,8 @@ my_getcwd()
 
        if( (dir = (char *)malloc(size)) == NULL)
                return NULL;
+
+       *dir = 0;
        
        while( getcwd(dir, size) == NULL && errno == ERANGE )
                if( (dir = (char *)realloc(dir, size *=2)) == NULL)