Fix off-by-one error in memory allocation: j entries, one new and a null

terminator is j + 2.

Submitted by:	Christoph Mallon <christoph.mallon@gmx.de>

diff --git a/pw/pw_user.c b/pw/pw_user.c
index 7df6b8598f10291796f0fb7516f6ffe2fa790268..43119ed82a3bf9a8293df58e7ea34d7f1abdbaf2 100644 (file)
--- a/pw/pw_user.c
+++ b/pw/pw_user.c
@@ -756,7 +756,7 @@ pw_user(struct userconf * cnf, int mode, struct cargs * args)
                        if (grp->gr_mem[j] != NULL) /* user already member of group */
                                continue;
 
-                       members = malloc(sizeof(char *) * (j + 1));
+                       members = malloc(sizeof(char *) * (j + 2));
                        for (j = 0; grp->gr_mem[j] != NULL; j++)
                                members[j] = grp->gr_mem[j];