- Fix the code in sbuf_need() to double the allocation size until

   the new content size fits into the sbuf, instead of assuming
   that allocating twice the old size is enough.
 - Use memmove(3) rather than strcpy(3) to copy overlapping
   strings.

PR:		bin/39930

1 files changed, 17 insertions, 9 deletions

diff --git a/usr.bin/makewhatis/makewhatis.c b/usr.bin/makewhatis/makewhatis.c
index ecf160a..0fef9a9 100644
--- a/usr.bin/makewhatis/makewhatis.c
+++ b/usr.bin/makewhatis/makewhatis.c
@@ -211,22 +211,30 @@ new_sbuf(void)
 }
 
 /*
- * Ensure that there is enough room in the sbuf for chars more characters.
+ * Ensure that there is enough room in the sbuf for nchars more characters.
  */
 static void
 sbuf_need(struct sbuf *sbuf, int nchars)
 {
-	/* let's assume we only need to double it, but check just in case */
+	char *new_content;
+	size_t size, cntsize;
+
+	/* double the size of the allocation until the buffer is big enough */
 	while (sbuf->end + nchars > sbuf->last) {
-		int alloc;
-		char *new_content;
+		size = sbuf->last + 1 - sbuf->content;
+		size *= 2;
+		cntsize = sbuf->end - sbuf->content;
+
+		printf("sbuf %p content %p;"
+		    " allocating %d bytes for %d bytes of content to hold"
+		    " %d bytes\n", sbuf, sbuf->content, size, cntsize, nchars);
 
-		alloc = (sbuf->last - sbuf->content + 1) * 2;
-		new_content = (char *) malloc(alloc);
-		memcpy(new_content, sbuf->content, sbuf->end - sbuf->content);
-		sbuf->end = new_content + (sbuf->end - sbuf->content);
+		new_content = (char *)malloc(size);
+		memcpy(new_content, sbuf->content, cntsize);
 		free(sbuf->content);
 		sbuf->content = new_content;
+		sbuf->end = new_content + cntsize;
+		sbuf->last = new_content + size - 1;
 	}
 }
 
@@ -616,7 +624,7 @@ process_mdoc_line(char *line)
 				next = strchr(next, '"');
 				if (next == NULL)
 					break;
-				strcpy(next, &next[1]);
+				memmove(next, next + 1, strlen(next));
 				line_end--;
 				if (*next != '"')
 					break;