From: Ralph Corderoy <ralph@inputplus.co.uk>
Date: Wed, 2 Nov 2016 23:25:14 +0000 (+0000)
Subject: dp: Fix write past end of dates[] array.
X-Git-Url: https://diplodocus.org/git/nmh/commitdiff_plain/57c33630533f1f4c057a44bfaa9e48e306dcd1f4?ds=inline;hp=e62400a894407812a6774c1a0eddde91142a42eb

dp: Fix write past end of dates[] array.

Not spotted by valgrind because that doesn't check heap or stack arrays.
---

diff --git a/uip/dp.c b/uip/dp.c
index 7e53a5c9..d771656a 100644
--- a/uip/dp.c
+++ b/uip/dp.c
@@ -49,7 +49,7 @@ main (int argc, char **argv)
     int datep = 0, width = -1, status = 0;
     char *cp, *form = NULL, *format = NULL, *nfs;
     char buf[BUFSIZ], **argp, **arguments;
-    char *dates[NDATES];
+    char *dates[NDATES + 1]; /* Includes terminating NULL. */
 
     if (nmh_init(argv[0], 2)) { return 1; }
 
@@ -92,7 +92,7 @@ main (int argc, char **argv)
 		    continue;
 	    }
 	}
-	if (datep > NDATES)
+	if (datep == NDATES)
 	    adios (NULL, "more than %d dates", NDATES);
 	else
 	    dates[datep++] = cp;