dp: Fix write past end of dates[] array.

Not spotted by valgrind because that doesn't check heap or stack arrays.

diff --git a/uip/dp.c b/uip/dp.c
index 7e53a5c9fc7f7f90d28841e8264605043510eda6..d771656a4425338ed3e91e65ea636b9318b7bd0a 100644 (file)
--- a/uip/dp.c
+++ b/uip/dp.c
@@ -49,7 +49,7 @@ main (int argc, char **argv)
     int datep = 0, width = -1, status = 0;
     char *cp, *form = NULL, *format = NULL, *nfs;
     char buf[BUFSIZ], **argp, **arguments;
     int datep = 0, width = -1, status = 0;
     char *cp, *form = NULL, *format = NULL, *nfs;
     char buf[BUFSIZ], **argp, **arguments;

-    char *dates[NDATES];
+    char *dates[NDATES + 1]; /* Includes terminating NULL. */

 
     if (nmh_init(argv[0], 2)) { return 1; }
 
 
     if (nmh_init(argv[0], 2)) { return 1; }
 


@@ -92,7 +92,7 @@ main (int argc, char **argv)
                    continue;
            }
        }
                    continue;
            }
        }

-       if (datep > NDATES)
+       if (datep == NDATES)

            adios (NULL, "more than %d dates", NDATES);
        else
            dates[datep++] = cp;
            adios (NULL, "more than %d dates", NDATES);
        else
            dates[datep++] = cp;