From dea57a10e7d7850ea8263b5590c194cfc661c6ce Mon Sep 17 00:00:00 2001 From: Alex Pickering Date: Sat, 28 Sep 2019 14:40:14 -0400 Subject: Fixed some out of bounds writes --- src/ctemplates.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/ctemplates.c b/src/ctemplates.c index 52f4c25..d507d33 100644 --- a/src/ctemplates.c +++ b/src/ctemplates.c @@ -593,7 +593,7 @@ parse_loop(struct TMPL_token* head, struct TMPL_buf* errbuf){ start_of_name++; start_of_name++;//consume " size_t name_size = get_quoted_string(start_of_name,head->length); - char* loopname = (char*)malloc(sizeof(char)*name_size); + char* loopname = (char*)malloc(sizeof(char)*(name_size + 1)); memcpy(loopname,start_of_name,name_size); loopname[name_size] = '\0'; t->TMPL_tag.loop.loopname = loopname; @@ -675,7 +675,7 @@ parse_variable(struct TMPL_token* head, struct TMPL_buf* errbuf){ start_of_name++; start_of_name++; //consume " size_t name_size = get_quoted_string(start_of_name,head->length); - char* name = (char*)malloc(sizeof(char)*name_size); + char* name = (char*)malloc(sizeof(char)*(name_size + 1)); memcpy(name,start_of_name,name_size); name[name_size] = '\0'; t->TMPL_tag.var.varname = name; @@ -696,7 +696,7 @@ parse_variable(struct TMPL_token* head, struct TMPL_buf* errbuf){ start_of_default++; start_of_default++; //consume " size_t default_size = get_quoted_string(start_of_default,head->length); - char* def = (char*) malloc(sizeof(char)*default_size); + char* def = (char*) malloc(sizeof(char)*(default_size + 1)); def[default_size] = '\0'; memcpy(def,start_of_default,default_size); t->TMPL_tag.var.defaultval = def; -- cgit v1.2.3-70-g09d2