dictionary: Fix potential access beyond allocated memory.

This code replaces the dictionary's "var" array by another one, so it must
either update "var_cap" to the allocated size or allocate "var_cap" (not
"var_cnt") elements.  I chose the latter fix.

diff --git a/src/data/dictionary.c b/src/data/dictionary.c
index 43df1eb0e606100df70f98cc89408ab055c39402..f69d91e3605ed246302740c74e1cb2f47ef3d8f7 100644 (file)
--- a/src/data/dictionary.c
+++ b/src/data/dictionary.c
@@ -683,7 +683,7 @@ dict_reorder_vars (struct dictionary *d,
   assert (count == 0 || order != NULL);
   assert (count <= d->var_cnt);
 
-  new_var = xnmalloc (d->var_cnt, sizeof *new_var);
+  new_var = xnmalloc (d->var_cap, sizeof *new_var);
   memcpy (new_var, order, count * sizeof *new_var);
   for (i = 0; i < count; i++)
     {