Due to an apparent thinko, when printing a table in expanded mode
(\x), space would be allocated for 1 slot plus 1 byte per line,
instead of 1 slot per line plus 1 slot for the NULL terminator. When
the line count is small, reading or writing the terminator would
therefore access memory beyond what was allocated.
* We now have all the information we need to setup the formatting
* structures
*/
- dlineptr = pg_local_malloc((sizeof(*dlineptr) + 1) * dheight);
- hlineptr = pg_local_malloc((sizeof(*hlineptr) + 1) * hheight);
+ dlineptr = pg_local_malloc((sizeof(*dlineptr)) * (dheight + 1));
+ hlineptr = pg_local_malloc((sizeof(*hlineptr)) * (hheight + 1));
dlineptr->ptr = pg_local_malloc(dformatsize);
hlineptr->ptr = pg_local_malloc(hformatsize);