Fix off-by-one error that enabled the fuzzer to find a crash hole.

One has to allocate space for the trailing NUL, too.

diff --git a/misc.c b/misc.c
index 29846e23f6a5aef4aef9320ea180e8a0797a5800..71c7540669b2b3b8e178220360a89dd4cb8b9ea6 100644 (file)
--- a/misc.c
+++ b/misc.c
@@ -291,7 +291,7 @@ bool YES(const char* question, const char* yes_response, const char* no_response
 
         reply = get_input();
 
-        char* firstword = (char*) xmalloc(strlen(reply));
+        char* firstword = (char*) xmalloc(strlen(reply)+1);
         sscanf(reply, "%s", firstword);
 
         for (int i = 0; i < (int)strlen(firstword); ++i)