Open
Description
In more than one location, space is created with something like:
char* mem = malloc( strlen( text ) );
followed by something like:
strcpy(mem, text);
This only mallocs enough memory for the number of characters in the text, but not for the terminating null, so that the strcpy
writes outside the bounds of the allocated memory.
Better to do something like:
char* mem = malloc( strlen(text) + 1 ); // so that there's room for the terminating null.