PATCH: Fix multibyte memory allocation in `wcs_ztrdup()'

PATCH: Fix multibyte memory allocation in `wcs_ztrdup()'

[Frank Terbeck]

This was spotted by Thorsten Glaser from the mirbsd project.

`zalloc()' uses malloc(3) to allocate memory. wcslen(3) returns the
number of multibyte *characters* in a given string (N). The destination
string will have to be able to store N+1 wchar_ts, not N+1 bytes.

Regards, Frank
---
 Src/string.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/Src/string.c b/Src/string.c
index 2bd1bae..4d74aa0 100644
--- a/Src/string.c
+++ b/Src/string.c
@@ -64,7 +64,7 @@ wcs_ztrdup(const wchar_t *s)
 
     if (!s)
 	return NULL;
-    t = (wchar_t *)zalloc(wcslen((wchar_t *)s) + 1);
+    t = (wchar_t *)zalloc(sizeof(wchar_t) * wcslen((wchar_t *)s) + 1);
     wcscpy(t, s);
     return t;
 }
-- 
1.7.4.rc1.7.g2cf08

Re: PATCH: Fix multibyte memory allocation in `wcs_ztrdup()'

[Peter Stephenson]

On Mon, 28 Feb 2011 11:35:00 +0100
Frank Terbeck <ft@bewatermyfriend.org> wrote:
> This was spotted by Thorsten Glaser from the mirbsd project.
> 
> `zalloc()' uses malloc(3) to allocate memory. wcslen(3) returns the
> number of multibyte *characters* in a given string (N). The
> destination string will have to be able to store N+1 wchar_ts, not
> N+1 bytes.

Thanks... and it needs to be a wide NULL (L'0'), too, so another
lot of parentheses is needed.

Index: Src/string.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/string.c,v
retrieving revision 1.10
diff -p -u -r1.10 string.c
--- Src/string.c	6 Jul 2007 21:52:39 -0000	1.10
+++ Src/string.c	28 Feb 2011 11:51:46 -0000
@@ -64,7 +64,7 @@ wcs_ztrdup(const wchar_t *s)
 
     if (!s)
 	return NULL;
-    t = (wchar_t *)zalloc(wcslen((wchar_t *)s) + 1);
+    t = (wchar_t *)zalloc(sizeof(wchar_t) * (wcslen((wchar_t *)s) + 1));
     wcscpy(t, s);
     return t;
 }

-- 
Peter Stephenson <pws@csr.com>            Software Engineer
Tel: +44 (0)1223 692070                   Cambridge Silicon Radio Limited
Churchill House, Cambridge Business Park, Cowley Road, Cambridge, CB4 0WZ, UK


Member of the CSR plc group of companies. CSR plc registered in England and Wales, registered number 4187346, registered office Churchill House, Cambridge Business Park, Cowley Road, Cambridge, CB4 0WZ, United Kingdom

Re: PATCH: Fix multibyte memory allocation in `wcs_ztrdup()'

[Frank Terbeck]

Peter Stephenson wrote:
> On Mon, 28 Feb 2011 11:35:00 +0100
> Frank Terbeck <ft@bewatermyfriend.org> wrote:
>> This was spotted by Thorsten Glaser from the mirbsd project.
>> 
>> `zalloc()' uses malloc(3) to allocate memory. wcslen(3) returns the
>> number of multibyte *characters* in a given string (N). The
>> destination string will have to be able to store N+1 wchar_ts, not
>> N+1 bytes.
>
> Thanks... and it needs to be a wide NULL (L'0'), too, so another
> lot of parentheses is needed.

Good point. :)