From the PR:

	FICL's TYPE copies the counted string to HERE, as abial has
remarked. Answering to abial's question, this is NOT garanteed to have
enough space.
...
	We have dynamic memory. Even before memory-alloc got in, we
already had dynamic memory. Use it, then! (ficlMalloc is sysdep, so I
suppose that's why it was not used for TYPE; ficl is probably designed
to work without a working ficlFree).

Submitted by:	"Daniel C. Sobral" <dcs@newsguy.com>

1 files changed, 7 insertions, 11 deletions

diff --git a/sys/boot/ficl/words.c b/sys/boot/ficl/words.c
index d7a420b..cc0db3d 100644
--- a/sys/boot/ficl/words.c
+++ b/sys/boot/ficl/words.c
@@ -2755,26 +2755,22 @@ static void type(FICL_VM *pVM)
 {
     UNS32 count = stackPopUNS32(pVM->pStack);
     char *cp    = stackPopPtr(pVM->pStack);
+    char *pDest = (char *)ficlMalloc(count);
 
     /* 
     ** Since we don't have an output primitive for a counted string
     ** (oops), make sure the string is null terminated. If not, copy
     ** and terminate it.
     */
-    /* XXX Uses free space on top of dictionary. Is it guaranteed
-     * XXX to always fit? (abial)
-     */
-    if (cp[count] != '\0')
-    {
-        char *pDest = (char *)ficlGetDict()->here;
-        if (cp != pDest)
-            strncpy(pDest, cp, count);
+    if (!pDest)
+	vmThrowErr(pVM, "Error: out of memory");
 
-        pDest[count] = '\0';
-        cp = pDest;
-    }
+    strncpy(pDest, cp, count);
+    pDest[count] = '\0';
 
     vmTextOut(pVM, cp, 0);
+
+    ficlFree(pDest);
     return;
 }