From 89eb1aaad8774a4a8d9f5b451ccdc10ed88c52d7 Mon Sep 17 00:00:00 2001
From: Chris Allegretta <chrisa@asty.org>
Date: Tue, 23 Oct 2001 13:21:20 +0000
Subject: [PATCH] - cut.c: cut_marked_segment() - Fix off-by one in mem
 allocation

git-svn-id: svn://svn.savannah.gnu.org/nano/branches/nano_1_0_branch/nano@869 35c25a1d-7b9e-4130-9fde-d3aeb78583b8
---
 ChangeLog | 3 +++
 cut.c     | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 861c624f..65d6e5d5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,9 @@ CVS code -
 	- Fixed null_at to ACTUALLY DO SOMETHING with its arg.  Again,
 	  this was causing nasty errors if the call to nrealloc moved
 	  where the data was located.
+- cut.c:
+  cut_marked_segment()
+	- Fix off-by one in mem allocation.
 - po/de.po:
 	- Updated German translation (Karl Eichwalder).
 
diff --git a/cut.c b/cut.c
index 7d1fd992..3de8f790 100644
--- a/cut.c
+++ b/cut.c
@@ -90,7 +90,7 @@ void cut_marked_segment(filestruct * top, int top_x, filestruct * bot,
     if (next == NULL)
 	return;
     /* Now, paste bot[bot_x] into top[top_x] */
-    tmpstr = nmalloc(strlen(top->data) + strlen(&bot->data[bot_x]));
+    tmpstr = nmalloc(top_x + strlen(&bot->data[bot_x]) + 1);
     strncpy(tmpstr, top->data, top_x);
     strcpy(&tmpstr[top_x], &bot->data[bot_x]);
     free(top->data);