Re: [Bug-ed] GNU Ed heap overflow

[Antonio Diaz Diaz]

Thank you for this bug report.

Please, test the included patch.

Regards,
Antonio.


--- signal.c~   2008-04-30 21:11:34.000000000 +0200
+++ signal.c    2008-07-01 19:19:43.000000000 +0200
@@ -200,15 +200,16 @@
   }


-/* return copy of escaped string of at most length PATH_MAX */
+/* return unescaped copy of escaped string */
 const char *strip_escapes( const char *s )
   {
   static char *file = 0;
   static int filesz = 0;
+  const int len = strlen( s );

   int i = 0;

-  if( !resize_buffer( (void *)&file, &filesz, path_max( 0 ) + 1 ) ) 
return 0;
+  if( !resize_buffer( (void *)&file, &filesz, len + 1 ) ) return 0;
   /* assert: no trailing escape */
   while( ( file[i++] = ( (*s == '\\' ) ? *++s : *s ) ) )
     s++;