[PATCH] off-by-one bugs found by valgrind

From: Pavel Roskin <proski@gnu.org>
Date: Dec 21, 2005, 20:35 UTC
Message-ID: <1135197348.3046.7.camel@dv>

Insufficient memory is allocated in index-pack.c to hold the *.idx name. One more byte should be allocated to hold the terminating 0.

quote_c_style_counted() in quote.c uses a dangerous construct, when a variable is incremented once and used twice in the same expression. Convert this construct to a more traditional form of the for loop.

Signed-off-by: Pavel Roskin <proski@gnu.org>

diff --git a/index-pack.c b/index-pack.c
index 785fe71..d4ce3af 100644
--- a/index-pack.c
+++ b/index-pack.c
@@ -440,7 +440,7 @@ int main(int argc, char **argv)
 		if (len < 5 || strcmp(pack_name + len - 5, ".pack"))
 			die("packfile name '%s' does not end with '.pack'",
 			    pack_name);
-		index_name_buf = xmalloc(len - 1);
+		index_name_buf = xmalloc(len);
 		memcpy(index_name_buf, pack_name, len - 5);
 		strcpy(index_name_buf + len - 5, ".idx");
 		index_name = index_name_buf;
diff --git a/quote.c b/quote.c
index 76eb144..00297b5 100644
--- a/quote.c
+++ b/quote.c
@@ -126,8 +126,10 @@ static int quote_c_style_counted(const c
 
 	if (!no_dq)
 		EMIT('"');
-	for (sp = name; (ch = *sp++) && (sp - name) <= namelen; ) {
-
+	for (sp = name; sp < name + namelen; sp++) {
+		ch = *sp;
+		if (!ch)
+			break;
 		if ((ch < ' ') || (ch == '"') || (ch == '\\') ||
 		    (ch == 0177)) {
 			needquote = 1;

-- 
Regards,
Pavel Roskin