Compute cursor after realloc, revisited

diff --git a/THANKS b/THANKS
index f3855ef9fd5092fd9222da9b69cdb514edee80f7..88b1db2f4aa550f3214bcd11fa1ebfd5c4f56b75 100644 (file)
--- a/THANKS
+++ b/THANKS
@@ -57,6 +57,7 @@ Dominique Schmit      dschmit@tabarly.saclay.cea.fr
 Duane Ellis            duane@franklin.com
                        http://www.franklin.com
 Eli Zaretskii          eliz@is.elta.co.il
+Enrik Berkhan          Enrik.Berkhan@planb.de
 Eric Backus            eric_backus@hp.com
                        http://www.wolfenet.com/~ericjb
 Eric Bischoff          eric@caldera.de

diff --git a/src/ChangeLog b/src/ChangeLog
index a5c8bf39804f98e5652998d95d234d3eebc4ebb8..c941fcc1e3b8d29f85e1989f7cabeb8ac6b1d80a 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -28,10 +28,11 @@
        * Makefile.am: Replace lib_LTLIBRARIES by noinst_LIBRARIES.
        Replace librecode.la by libcode.a and librecode_la by librecode_a.
 
-2001-10-08  Andreas Schwab  <schwab@suse.de>
+2001-10-08  François Pinard  <pinard@iro.umontreal.ca>
 
        * request.c (guarantee_nul_terminator): Fix bound computation for
        realloc.
+       Reported by Andreas Schwab and Enrik Berkhan.
 
 2001-07-01  Bruno Haible  <haible@clisp.cons.org>
 

diff --git a/src/request.c b/src/request.c
index 4643c31c616a9af59e4d15fca5a016e6f047a5a1..3e995db254778644179e1dc96e97641ec1aa869b 100644 (file)
--- a/src/request.c
+++ b/src/request.c
@@ -1073,13 +1073,13 @@ guarantee_nul_terminator (RECODE_TASK task)
   if (task->output.cursor + 4 >= task->output.limit)
     {
       RECODE_OUTER outer = task->request->outer;
-      size_t size = task->output.cursor + 4 - task->output.buffer;
+      size_t size = task->output.cursor - task->output.buffer;
 
       /* FIXME: Rethink about how the error should be reported.  */
-      if (REALLOC (task->output.buffer, size, char))
+      if (REALLOC (task->output.buffer, size + 4, char))
        {
-         task->output.cursor = task->output.buffer + size - 4;
-         task->output.limit = task->output.buffer + size;
+         task->output.cursor = task->output.buffer + size;
+         task->output.limit = task->output.buffer + size + 4;
        }
     }
   task->output.cursor[0] = NUL;