ods-reader: Fix write beyond end of buffer.

The compiler multiplies by sizeof *var_spec for us here, so doing
it ourselves writes past the end of the allocated space.

Tracked down with valgrind.

Reported-by: bojo42 <bojo42@gmail.com>

diff --git a/src/data/ods-reader.c b/src/data/ods-reader.c
index 122e98c76d90060da92d7e79bca19adcc2599ff0..aedea078dfc34d82242a3783aeaef8e86e03b76a 100644 (file)
--- a/src/data/ods-reader.c
+++ b/src/data/ods-reader.c
@@ -462,7 +462,7 @@ ods_open_reader (struct spreadsheet_read_info *gri, struct dictionary **dict)
                  var_spec = xrealloc (var_spec, sizeof (*var_spec) * (idx + 1));
 
                  /* xrealloc (unlike realloc) doesn't initialise its memory to 0 */
-                 memset (var_spec + n_var_specs * sizeof (*var_spec),
+                 memset (var_spec + n_var_specs,
                          0, 
                          (n_var_specs - idx + 1) * sizeof (*var_spec));
                  n_var_specs = idx + 1;