//bugs.freedesktop.org/show_bug.cgi?id=1818) attachment #1286XORG-6_8_2XORG-6_8_1_904XORG-6_8_1_903XORG-6_8_1_902XORG-6_8_1_901XORG-6_8-branch

    (https://bugs.freedesktop.org/attachment.cgi?id=1286): Fixing
    off-by-one allocation error. Patch by Kristian Høgsberg
    <krh@bitplanet.net>.

1 files changed, 16 insertions, 4 deletions

diff --git a/xmodmap.c b/xmodmap.c
index a67493f..c59f07b 100644
--- a/xmodmap.c
+++ b/xmodmap.c
@@ -51,6 +51,16 @@ Exit(int status)
     exit (status);
 }
 
+void *
+chk_malloc(size_t n_bytes)
+{
+    void *buf = malloc(n_bytes);
+    if (!buf) {
+	fprintf(stderr, "%s: Could not allocate %d bytes\n", ProgramName, (int)n_bytes);
+	Exit(-1);
+    }
+    return buf;
+}
 
 static char *help_message[] = {
 "\nwhere options include:",
@@ -244,9 +254,10 @@ main(int argc, char *argv[])
 	      case 's':
 	      case 'l':
 	      case 'c': {
-		  char cmd[80];		/* big enough to hold line */
+		  char *cmd;
 		  didAnything = True;
 		  if (++i >= argc) usage ();
+		  cmd = chk_malloc (strlen ("remove control = ") + strlen (argv[i]) + 1);
 		  (void) sprintf (cmd, "remove %s = %s",
 				  ((arg[1] == 's') ? "shift" :
 				   ((arg[1] == 'l') ? "lock" :
@@ -265,10 +276,10 @@ main(int argc, char *argv[])
 	      case '3':
 	      case '4':
 	      case '5': {
-		  char cmd[80];		/* big enough to hold line */
+		  char *cmd;
 		  didAnything = True;
 		  if (++i >= argc) usage ();
-
+		  cmd = chk_malloc (strlen ("add modX = ") + strlen (argv[i]) + 1);
 		  (void) sprintf (cmd, "add mod%c = %s", arg[1], argv[i]);
 		  process_line (cmd);
 		  continue;
@@ -281,9 +292,10 @@ main(int argc, char *argv[])
 	      case 's':
 	      case 'l':
 	      case 'c': {
-		  char cmd[80];		/* big enough to hold line */
+		  char *cmd;
 		  didAnything = True;
 		  if (++i >= argc) usage ();
+		  cmd = chk_malloc (strlen ("add control = ") + strlen (argv[i]) + 1);
 		  (void) sprintf (cmd, "add %s = %s",
 				  ((arg[1] == 's') ? "shift" :
 				   ((arg[1] == 'l') ? "lock" :