off-by-one in malloc.c (from Ilya Zakharevich)

p4raw-id: //depot/perl@4974

diff --git a/malloc.c b/malloc.c
index 734ea06..5e85661 100644 (file)
--- a/malloc.c
+++ b/malloc.c
@@ -1748,9 +1748,9 @@ char *
 Perl_strdup(const char *s)
 {
     MEM_SIZE l = strlen(s);
-    char *s1 = (char *)Perl_malloc(l);
+    char *s1 = (char *)Perl_malloc(l+1);
 
-    Copy(s, s1, (MEM_SIZE)l, char);
+    Copy(s, s1, (MEM_SIZE)(l+1), char);
     return s1;
 }
 
@@ -1776,8 +1776,8 @@ Perl_putenv(char *a)
   else
       var = Perl_malloc(l + 1);
   Copy(a, var, l, char);
-  val++;
-  my_setenv(var,val);
+  var[l + 1] = 0;
+  my_setenv(var, val+1);
   if (var != buf)
       Perl_mfree(var);
   return 0;