1 --- a/src/encode.c

     2 +++ b/src/encode.c

     3 @@ -194,10 +194,12 @@ int encode_init(void) {

     4  

     5  char *pr_decode_str(pool *p, const char *in, size_t inlen, size_t *outlen) {

     6  #ifdef HAVE_ICONV

     7 -  size_t inbuflen, outbuflen;

     8 +  size_t inbuflen, outbuflen, outbufsz;

     9    char *inbuf, outbuf[PR_TUNABLE_PATH_MAX*2], *res = NULL;

    10  

    11 -  if (!p || !in || !outlen) {

    12 +  if (p == NULL ||

    13 +      in == NULL ||

    14 +      outlen == NULL) {

    15      errno = EINVAL;

    16      return NULL;

    17    }

    18 @@ -229,7 +231,11 @@ char *pr_decode_str(pool *p, const char *in, size_t inlen, size_t *outlen) {

    19      return NULL;

    20  

    21    *outlen = sizeof(outbuf) - outbuflen;

    22 -  res = pcalloc(p, *outlen);

    23 +

    24 +  /* We allocate one byte more, for a terminating NUL. */

    25 +  outbufsz = sizeof(outbuf) - outbuflen + 1;

    26 +  res = pcalloc(p, outbufsz);

    27 +

    28    memcpy(res, outbuf, *outlen);

    29  

    30    return res;

    31 @@ -242,10 +248,12 @@ char *pr_decode_str(pool *p, const char *in, size_t inlen, size_t *outlen) {

    32  

    33  char *pr_encode_str(pool *p, const char *in, size_t inlen, size_t *outlen) {

    34  #ifdef HAVE_ICONV

    35 -  size_t inbuflen, outbuflen;

    36 +  size_t inbuflen, outbuflen, outbufsz;

    37    char *inbuf, outbuf[PR_TUNABLE_PATH_MAX*2], *res;

    38  

    39 -  if (!p || !in || !outlen) {

    40 +  if (p == NULL ||

    41 +      in == NULL ||

    42 +      outlen == NULL) {

    43      errno = EINVAL;

    44      return NULL;

    45    }

    46 @@ -277,7 +285,11 @@ char *pr_encode_str(pool *p, const char *in, size_t inlen, size_t *outlen) {

    47      return NULL;

    48  

    49    *outlen = sizeof(outbuf) - outbuflen;

    50 -  res = pcalloc(p, *outlen);

    51 +

    52 +  /* We allocate one byte more, for a terminating NUL. */

    53 +  outbufsz = sizeof(outbuf) - outbuflen + 1;

    54 +

    55 +  res = pcalloc(p, outbufsz);

    56    memcpy(res, outbuf, *outlen);

    57  

    58    return res;

    59 diff --git a/src/fsio.c b/src/fsio.c

    60 index 40ef466..8bf5069 100644

    61 --- a/src/fsio.c

    62 +++ b/src/fsio.c

    63 @@ -2058,7 +2058,7 @@ char *pr_fs_decode_path(pool *p, const char *path) {

    64      return (char *) path;

    65    }

    66  

    67 -  res = pr_decode_str(p, path, strlen(path) + 1, &outlen);

    68 +  res = pr_decode_str(p, path, strlen(path), &outlen);

    69    if (!res) {

    70      pr_trace_msg("encode", 1, "error decoding path '%s': %s", path,

    71        strerror(errno));

    72 @@ -2081,7 +2081,7 @@ char *pr_fs_encode_path(pool *p, const char *path) {

    73      return (char *) path;

    74    }

    75  

    76 -  res = pr_encode_str(p, path, strlen(path) + 1, &outlen);

    77 +  res = pr_encode_str(p, path, strlen(path), &outlen);

    78    if (!res) {

    79      pr_trace_msg("encode", 1, "error encoding path '%s': %s", path,

    80        strerror(errno));

    81