Malfunction of gcry_sexp_car

[Benjamin Pousse]

Hello,

Le vendredi 17 février 2012 à 17:17 +0100, Werner Koch a écrit : 
> On Thu, 16 Feb 2012 22:09, benjamin.pousse at member.fsf.org said:
> 
> > Please find at the end of this mail my patch to solve this problem (the
> > patch is large because I apply a regular indentation on the full
> > function).
> 
> Thanks for looking into this.
> 
> Can you please send a patch without that indentation change.  That makes
> it easier to see what you did.
Of course. Here it is.

Regards,
Benjamin.


diff --git a/src/sexp.c b/src/sexp.c
index 0877773..2450c82 100644
--- a/src/sexp.c
+++ b/src/sexp.c
@@ -576,13 +576,24 @@ gcry_sexp_nth( const gcry_sexp_t list, int number
)
     p++;

     if ( *p == ST_DATA ) {
- memcpy ( &n, p, sizeof n ); p += sizeof n;
- newlist = gcry_malloc ( sizeof *newlist + n + 1 );
+ memcpy ( &n, p, sizeof n );
+    /* Allocate 1 (=sizeof *newlist) byte for ST_OPEN
+                1 byte for ST_DATA
+                sizeof n byte for n
+                n byte for the data
+                1 byte for ST_CLOSE
+                1 byte for ST_STOP */
+ newlist = gcry_malloc ( sizeof *newlist + 1 + sizeof n + n + 2 );
         if (!newlist)
           return NULL;
d = newlist->d;
- memcpy ( d, p, n ); d += n;
- *d++ = ST_STOP;
+ *d = ST_OPEN;   /* Put the ST_OPEN flag */
+ d++;            /* Move forward */
+ memcpy ( d, p, 1 + sizeof n + n );  /* Copy ST_DATA, n and the data
from p to d */
+    d += 1 + sizeof n + n;  /* Move after the data copied */
+ *d = ST_CLOSE;          /* Put the ST_CLOSE flag */
+ d++;                    /* Move forward */
+ *d = ST_STOP;           /* Put the ST_STOP flag */
     }
     else if ( *p == ST_OPEN ) {
const byte *head = p;