ap: Fix write past end of addrs[] array.

Not spotted by valgrind because that doesn't check heap or stack arrays.

diff --git a/uip/ap.c b/uip/ap.c
index 89b207b57e3a4c73a699b8d4b27dd2967cbf4d1e..b158416ad891475e8679d592ce2a0c84a06dddcf 100644 (file)
--- a/uip/ap.c
+++ b/uip/ap.c
@@ -51,7 +51,7 @@ main (int argc, char **argv)
     int width = -1, status = 0;
     char *cp, *form = NULL, *format = NULL, *nfs;
     char buf[BUFSIZ], **argp;
     int width = -1, status = 0;
     char *cp, *form = NULL, *format = NULL, *nfs;
     char buf[BUFSIZ], **argp;

-    char **arguments, *addrs[NADDRS];
+    char **arguments, *addrs[NADDRS + 1]; /* Includes terminating NULL. */

 
     if (nmh_init(argv[0], 2)) { return 1; }
 
 
     if (nmh_init(argv[0], 2)) { return 1; }
 


@@ -96,7 +96,7 @@ main (int argc, char **argv)
                    continue;
            }
        }
                    continue;
            }
        }

-       if (addrp > NADDRS)
+       if (addrp == NADDRS)

            adios (NULL, "more than %d addresses", NADDRS);
        else
            addrs[addrp++] = cp;
            adios (NULL, "more than %d addresses", NADDRS);
        else
            addrs[addrp++] = cp;