The previous fix for "type" was absolutely lousy. Not only the buffer

allocated was not big enough, but it ended up to being used where it
was supposed to be used. The person who did that ought to be shot, but
since I'm a good person, I'll forgive myself...

PR:		bin/9743

1 files changed, 2 insertions, 2 deletions

diff --git a/sys/boot/ficl/words.c b/sys/boot/ficl/words.c
index 04cbc0a..dadeaaa 100644
--- a/sys/boot/ficl/words.c
+++ b/sys/boot/ficl/words.c
@@ -2781,7 +2781,7 @@ static void type(FICL_VM *pVM)
 {
     UNS32 count = stackPopUNS32(pVM->pStack);
     char *cp    = stackPopPtr(pVM->pStack);
-    char *pDest = (char *)ficlMalloc(count);
+    char *pDest = (char *)ficlMalloc(count + 1);
 
     /* 
     ** Since we don't have an output primitive for a counted string
@@ -2794,7 +2794,7 @@ static void type(FICL_VM *pVM)
     strncpy(pDest, cp, count);
     pDest[count] = '\0';
 
-    vmTextOut(pVM, cp, 0);
+    vmTextOut(pVM, pDest, 0);
 
     ficlFree(pDest);
     return;