The the loop used to expand %h and %u, the lastchar variable was not being

initialized.  This means that if the last char in the prompt is '%' and the
first char is 'h' or 'u' a extra copy of the host or user name would be
copied, for which space had not been allocated.

diff --git a/check.c b/check.c
index 5bb31508604396c01636dd61618464623d22fdbe..837ad5b5a6dfbd6be4580e9b8aad8f16f9d2016c 100644 (file)
--- a/check.c
+++ b/check.c
@@ -196,9 +196,9 @@ expand_prompt(old_prompt, user, host)
 
     if (subst) {
        new_prompt = (char *) emalloc(len + 1);
-       for (p = old_prompt, np = new_prompt; *p; p++) {
+       for (p = old_prompt, np = new_prompt, lastchar = '\0'; *p; p++) {
            if (lastchar == '%' && (*p == 'h' || *p == 'u' || *p == '%')) {
-               /* substiture user/host name */
+               /* substitute user/host name */
                if (*p == 'h') {
                    np--;
                    strcpy(np, user_shost);