Author: cazfi
Date: Wed Aug  5 19:58:47 2015
New Revision: 29341

URL: http://svn.gna.org/viewcvs/freeciv?rev=29341&view=rev
Log:
Fixed memory corruption problem in the handling of string comparison buffers.

Reported by Jacob Nevins <jtn>

See bug #23742

Modified:
    trunk/utility/support.c

Modified: trunk/utility/support.c
URL: 
http://svn.gna.org/viewcvs/freeciv/trunk/utility/support.c?rev=29341&r1=29340&r2=29341&view=diff
==============================================================================
--- trunk/utility/support.c     (original)
+++ trunk/utility/support.c     Wed Aug  5 19:58:47 2015
@@ -123,8 +123,8 @@
     cmp_buffer1 = fc_malloc((cmp_buffer_uchars + 1) * sizeof(UChar));
 
     /* Make sure there's zero after the buffer published with 
cmp_buffer_uchars */
-    memset(cmp_buffer0 + cmp_buffer_uchars * sizeof(UChar), 0, sizeof(UChar));
-    memset(cmp_buffer1 + cmp_buffer_uchars * sizeof(UChar), 0, sizeof(UChar));
+    cmp_buffer0[cmp_buffer_uchars] = 0;
+    cmp_buffer1[cmp_buffer_uchars] = 0;
   }
 }
 
@@ -138,8 +138,8 @@
   cmp_buffer1 = fc_realloc(cmp_buffer1, (cmp_buffer_uchars + 1) * 
sizeof(UChar));
 
   /* Make sure there's zero after the buffer published with cmp_buffer_uchars 
*/
-  memset(cmp_buffer0 + cmp_buffer_uchars * sizeof(UChar), 0, sizeof(UChar));
-  memset(cmp_buffer1 + cmp_buffer_uchars * sizeof(UChar), 0, sizeof(UChar));
+  cmp_buffer0[cmp_buffer_uchars] = 0;
+  cmp_buffer1[cmp_buffer_uchars] = 0;
 }
 
 /***************************************************************


_______________________________________________
Freeciv-commits mailing list
Freeciv-commits@gna.org
https://mail.gna.org/listinfo/freeciv-commits

Reply via email to