webkit2gtk3/webkit2gtk3-boo1101999-off-by-one.patch

Index: Source/ThirdParty/xdgmime/src/xdgmimecache.c
===================================================================
--- Source/ThirdParty/xdgmime/src/xdgmimecache.c	(revision 233403)
+++ Source/ThirdParty/xdgmime/src/xdgmimecache.c	(revision 233404)
@@ -1047,6 +1047,9 @@
   xdg_uint32_t child_offset;
   int i;
 
+  assert (*n >= 0);
+  assert (depth >= 0);
+
   if (*n >= n_globs)
     return FALSE;
 
@@ -1055,7 +1058,7 @@
       xdg_uint32_t mime_offset = GET_UINT32 (cache->buffer, offset + 4);
 
       if (strcasecmp (cache->buffer + mime_offset, mime) == 0) {
-        globs[*n] = malloc (depth * sizeof (char));
+        globs[*n] = malloc ((depth + 1) * sizeof (char));
         for (i = 0; i < depth; i++)
           globs[*n][depth - i - 1] = prefix[i];
         globs[*n][depth] = '\0';
Index: Source/ThirdParty/xdgmime/src/xdgmimeglob.c
===================================================================
--- Source/ThirdParty/xdgmime/src/xdgmimeglob.c	(revision 233403)
+++ Source/ThirdParty/xdgmime/src/xdgmimeglob.c	(revision 233404)
@@ -484,6 +484,9 @@
                   xdg_unichar_t   *prefix,
                   int              depth)
 {
+  assert (*n >= 0);
+  assert (depth >= 0);
+
   if (*n >= n_globs)
     return FALSE;
 
@@ -495,7 +498,7 @@
         {
           int i;
 
-          globs[*n] = malloc (depth * sizeof (char));
+          globs[*n] = malloc ((depth + 1) * sizeof (char));
           for (i = 0; i < depth; i++)
             globs[*n][depth - i - 1] = prefix[i];
           globs[*n][depth] = '\0';