Tue Dec 8 19:19:39 1998 Norbert Warmuth <nwarmuth@privat.circular.de>

* cmd.c (dirsizes_cmd): Fixed possible buffer overflow

src/ChangeLog

@@ -1,3 +1,7 @@
+Tue Dec  8 19:19:39 1998  Norbert Warmuth  <nwarmuth@privat.circular.de>
+
+	* cmd.c (dirsizes_cmd): Fixed possible buffer overflow
+
 1998-12-07  Miguel de Icaza  <miguel@nuclecu.unam.mx>
 
 	* screen.c (do_enter): Return the value from this.

src/cmd.c

@@ -1368,7 +1368,9 @@ void dirsizes_cmd (void)
             j += strlen (panel->dir.list [i].fname) + 1;
     if (!j)
         return;
-    cmd = xmalloc (strlen (dirsizes_command) + j + 1, "dirsizes_cmd");
+    /* worst case: name_quote doubles every filename, i.e. use
+       2 * j to be save */
+    cmd = xmalloc (strlen (dirsizes_command) + 2 * j + 1, "dirsizes_cmd");
     strcpy (cmd, dirsizes_command);
     p = strchr (cmd, 0);
     for (i = 0; i < panel->count; i++)