Fix buffer overflow reported by John Darrington.

[pspp] / src / language / dictionary / weight.c

diff --git a/src/language/dictionary/weight.c b/src/language/dictionary/weight.c
index 121728b68e454b8d371e750f91cbb093eb4ab9a1..ec6d712bb7cf29903b29296bb0fe55bba000691f 100644 (file)
--- a/src/language/dictionary/weight.c
+++ b/src/language/dictionary/weight.c
@@ -21,11 +21,12 @@
 
 #include <stdio.h>
 
-#include <procedure.h>
+#include <data/procedure.h>
 #include <data/dictionary.h>
 #include <data/variable.h>
 #include <language/command.h>
 #include <language/lexer/lexer.h>
+#include <language/lexer/variable-parser.h>
 #include <libpspp/message.h>
 #include <libpspp/str.h>
 
@@ -33,16 +34,17 @@
 #define _(msgid) gettext (msgid)
 
 int
-cmd_weight (void)
+cmd_weight (struct dataset *ds)
 {
+  struct dictionary *dict = dataset_dict (ds);
   if (lex_match_id ("OFF"))
-    dict_set_weight (default_dict, NULL);
+    dict_set_weight (dataset_dict (ds), NULL);
   else
     {
       struct variable *v;
 
       lex_match (T_BY);
-      v = parse_variable ();
+      v = parse_variable (dict);
       if (!v)
        return CMD_CASCADING_FAILURE;
       if (v->type == ALPHA)
@@ -56,7 +58,7 @@ cmd_weight (void)
          return CMD_CASCADING_FAILURE;
        }
 
-      dict_set_weight (default_dict, v);
+      dict_set_weight (dict, v);
     }
 
   return lex_end_of_command ();