Fixed some out of bounds writes

1 files changed, 3 insertions, 3 deletions

diff --git a/src/ctemplates.c b/src/ctemplates.c
index 52f4c25..d507d33 100644
--- a/src/ctemplates.c
+++ b/src/ctemplates.c
@@ -593,7 +593,7 @@ parse_loop(struct TMPL_token* head, struct TMPL_buf* errbuf){
 			start_of_name++;
 		start_of_name++;//consume "
 		size_t name_size = get_quoted_string(start_of_name,head->length);
-		char* loopname = (char*)malloc(sizeof(char)*name_size);
+		char* loopname = (char*)malloc(sizeof(char)*(name_size + 1));
 		memcpy(loopname,start_of_name,name_size);
 		loopname[name_size] = '\0';
 		t->TMPL_tag.loop.loopname = loopname;
@@ -675,7 +675,7 @@ parse_variable(struct TMPL_token* head, struct TMPL_buf* errbuf){
 			start_of_name++;
 		start_of_name++; //consume "
 		size_t name_size = get_quoted_string(start_of_name,head->length);
-		char* name = (char*)malloc(sizeof(char)*name_size);
+		char* name = (char*)malloc(sizeof(char)*(name_size + 1));
 		memcpy(name,start_of_name,name_size);
 		name[name_size] = '\0';
 		t->TMPL_tag.var.varname = name;
@@ -696,7 +696,7 @@ parse_variable(struct TMPL_token* head, struct TMPL_buf* errbuf){
 			start_of_default++;
 		start_of_default++; //consume "
 		size_t default_size = get_quoted_string(start_of_default,head->length);
-		char* def = (char*) malloc(sizeof(char)*default_size);
+		char* def = (char*) malloc(sizeof(char)*(default_size + 1));
 		def[default_size] = '\0';
 		memcpy(def,start_of_default,default_size);
 		t->TMPL_tag.var.defaultval = def;