Compute cursor correctly after realloc

diff --git a/src/ChangeLog b/src/ChangeLog
index 183061773ef4821fa95d072b6aedc8885046f204..bb7e762561765456efc707d5a3a57e67f627dba2 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -23,6 +23,11 @@
        * Makefile.am: Replace lib_LTLIBRARIES by noinst_LIBRARIES.
        Replace librecode.la by libcode.a and librecode_la by librecode_a.
 
+2001-10-08  Andreas Schwab  <schwab@suse.de>
+
+       * request.c (guarantee_nul_terminator): Fix bound computation for
+       realloc.
+
 2001-07-01  Bruno Haible  <haible@clisp.cons.org>
 
        * task.c (perform_pass_sequence): Call recode_if_nogo before

diff --git a/src/request.c b/src/request.c
index 9fbcc38bca53a5276333f67f60be589e2b8b13f0..4643c31c616a9af59e4d15fca5a016e6f047a5a1 100644 (file)
--- a/src/request.c
+++ b/src/request.c
@@ -1,5 +1,5 @@
 /* Conversion of files between different charsets and surfaces.
-   Copyright © 1990,92,93,94,96,97,98,99,00 Free Software Foundation, Inc.
+   Copyright © 1990,92,93,94,96,97,98,99,00,01 Free Software Foundation, Inc.
    Contributed by François Pinard <pinard@iro.umontreal.ca>, 1990.
 
    This library is free software; you can redistribute it and/or
@@ -1073,14 +1073,13 @@ guarantee_nul_terminator (RECODE_TASK task)
   if (task->output.cursor + 4 >= task->output.limit)
     {
       RECODE_OUTER outer = task->request->outer;
-      size_t old_size = task->output.limit - task->output.buffer;
-      size_t new_size = task->output.cursor + 4 - task->output.buffer;
+      size_t size = task->output.cursor + 4 - task->output.buffer;
 
       /* FIXME: Rethink about how the error should be reported.  */
-      if (REALLOC (task->output.buffer, new_size, char))
+      if (REALLOC (task->output.buffer, size, char))
        {
-         task->output.cursor = task->output.buffer + old_size;
-         task->output.limit = task->output.buffer + new_size;
+         task->output.cursor = task->output.buffer + size - 4;
+         task->output.limit = task->output.buffer + size;
        }
     }
   task->output.cursor[0] = NUL;