Fix bug #3201 "Fix memory corruption in sc_html_read_line()"

Previously fread() could fill the whole buffer
in which case buf[n] = '\0' messed up the stack.

Introduced in d0c64a09 + 4ab3585743.

diff --git a/src/html.c b/src/html.c
index f7b0ac42f1293781cc407f9204dac8454f2070ca..71338af1fc27bd4d2c337e3c70336bd416220370 100644 (file)
--- a/src/html.c
+++ b/src/html.c
@@ -445,7 +445,7 @@ static SC_HTMLState sc_html_read_line(SC_HTMLParser *parser)
        if (parser->fp == NULL)
                return SC_HTML_EOF;
 
-       n = fread(buf, 1, sizeof(buf), parser->fp);
+       n = fread(buf, 1, sizeof(buf) - 1, parser->fp);
        if (n == 0) {
                parser->state = SC_HTML_EOF;
                return SC_HTML_EOF;