FIX: Fixed buffer overflow in RL_Word_String()

Oldes · Oldes · commit cdfe7a869bb8 · 2019-03-13T18:58:42.000+01:00
As reported by @meshpoint in PR: rebolsource#4
diff --git a/src/core/a-lib.c b/src/core/a-lib.c
@@ -756,7 +756,7 @@ RL_API REBYTE *RL_Word_String(u32 word)
 {
 	REBYTE *s1, *s2;
 	s1 = Get_Sym_Name(word);
-	s2 = OS_MAKE(strlen(cs_cast(s1)));
+	s2 = OS_MAKE(strlen(cs_cast(s1)) + 1);
 	strcpy(s_cast(s2), cs_cast(s1));
 	return s2;
 }

Original file line number	Diff line number	Diff line change
`@@ -756,7 +756,7 @@ RL_API REBYTE *RL_Word_String(u32 word)`
`756`	`756`	`{`
`757`	`757`	`REBYTE s1, s2;`
`758`	`758`	`s1 = Get_Sym_Name(word);`
`759`		`- s2 = OS_MAKE(strlen(cs_cast(s1)));`
	`759`	`+ s2 = OS_MAKE(strlen(cs_cast(s1)) + 1);`
`760`	`760`	`strcpy(s_cast(s2), cs_cast(s1));`
`761`	`761`	`return s2;`
`762`	`762`	`}`