2007-03-16 Charles Wilson <cygwin@...>

        * libc/argz/argz_insert.c: "before" pointer is
        invalid after *argz realloc.  Compute offset
        between "before" and *argz, and use it after
        reallocation instead.

2 files changed, 12 insertions, 2 deletions

diff --git a/newlib/ChangeLog b/newlib/ChangeLog
index df161dcf0..50a5b3727 100644
--- a/newlib/ChangeLog
+++ b/newlib/ChangeLog
@@ -1,3 +1,10 @@
+2007-03-16  Charles Wilson  <cygwin@...>
+
+	* libc/argz/argz_insert.c: "before" pointer is
+	invalid after *argz realloc.  Compute offset
+	between "before" and *argz, and use it after
+	reallocation instead.
+
 2007-03-16  Eric Blake  <ebb9@byu.net>
 
 	* libc/stdio64/fseek064.c (_fseeko64_r): Fix reentrancy.
diff --git a/newlib/libc/argz/argz_insert.c b/newlib/libc/argz/argz_insert.c
index 8a9fb19b2..3ae662116 100644
--- a/newlib/libc/argz/argz_insert.c
+++ b/newlib/libc/argz/argz_insert.c
@@ -28,13 +28,16 @@ _DEFUN (argz_insert, (argz, argz_len, before, entry),
   while (before != *argz && before[-1])
     before--;
 
+  /* delta will always be non-negative, and < *argz_len */
+  ptrdiff_t delta = before - *argz;
+
   len = strlen(entry) + 1;
 
   if(!(*argz = (char *)realloc(*argz, *argz_len + len)))
     return ENOMEM;
   
-  memmove(before + len, before, *argz + *argz_len - before);
-  memcpy(before, entry, len);
+  memmove(*argz + delta + len, *argz + delta,  *argz_len - delta);
+  memcpy(*argz + delta, entry, len);
 
   *argz_len += len;