fixed a string termination bug in the uidlist handling code. I've also

added a read_sbuf() routine that fixes this kind of bug generically to
avoid similar problems in future.

1 files changed, 4 insertions, 4 deletions

diff --git a/uidlist.c b/uidlist.c
index 962bb8c8..4aa098f8 100644
--- a/uidlist.c
+++ b/uidlist.c
@@ -256,9 +256,9 @@ void recv_uid_list(int f, struct file_list *flist)
 		id = read_int(f);
 		while (id != 0) {
 			int len = read_byte(f);
-			name = (char *)malloc(len);
+			name = (char *)malloc(len+1);
 			if (!name) out_of_memory("recv_uid_list");
-			read_buf(f, name, len);
+			read_sbuf(f, name, len);
 			if (!list) {
 				uidlist = add_list(id, name);
 				list = uidlist;
@@ -279,9 +279,9 @@ void recv_uid_list(int f, struct file_list *flist)
 		id = read_int(f);
 		while (id != 0) {
 			int len = read_byte(f);
-			name = (char *)malloc(len);
+			name = (char *)malloc(len+1);
 			if (!name) out_of_memory("recv_uid_list");
-			read_buf(f, name, len);
+			read_sbuf(f, name, len);
 			if (!list) {
 				gidlist = add_list(id, name);
 				list = gidlist;