vncv: realloc memory corruption

vncv: realloc memory corruption

[qwx]

Hello,

In /sys/src/cmd/vnc/wsys.c:/^getsnarf, /dev/snarf's contents
are being read into a buffer, which is grown in 8192 byte increments
using realloc.

The code assumes that realloc will always return the same pointer,
and the p variable is never updated.  On subsequent reads, memory
may be corrupted.

I've hit this multiple times when snarfing a large amount of text
while a vncv is running.

Example:

% vncv host
# in another window:
% cat /lib/dicewords >/dev/snarf

The following patch fixes this.

Any objections to merging this?

Thanks,

qwx

diff -r bb28fe19fe44 sys/src/cmd/vnc/wsys.c
--- a/sys/src/cmd/vnc/wsys.c	Mon Aug 19 16:42:20 2019 +0200
+++ b/sys/src/cmd/vnc/wsys.c	Mon Aug 26 00:49:19 2019 +0200
@@ -281,6 +281,7 @@
 			*sz += c;
 			if (n == 0){
 				snarf = realloc(snarf, *sz + 8192);
+				p = snarf + *sz;
 				n = 8192;
 			}
 		}