Index: Source/ThirdParty/xdgmime/src/xdgmimecache.c =================================================================== --- Source/ThirdParty/xdgmime/src/xdgmimecache.c (revision 233403) +++ Source/ThirdParty/xdgmime/src/xdgmimecache.c (revision 233404) @@ -1047,6 +1047,9 @@ xdg_uint32_t child_offset; int i; + assert (*n >= 0); + assert (depth >= 0); + if (*n >= n_globs) return FALSE; @@ -1055,7 +1058,7 @@ xdg_uint32_t mime_offset = GET_UINT32 (cache->buffer, offset + 4); if (strcasecmp (cache->buffer + mime_offset, mime) == 0) { - globs[*n] = malloc (depth * sizeof (char)); + globs[*n] = malloc ((depth + 1) * sizeof (char)); for (i = 0; i < depth; i++) globs[*n][depth - i - 1] = prefix[i]; globs[*n][depth] = '\0'; Index: Source/ThirdParty/xdgmime/src/xdgmimeglob.c =================================================================== --- Source/ThirdParty/xdgmime/src/xdgmimeglob.c (revision 233403) +++ Source/ThirdParty/xdgmime/src/xdgmimeglob.c (revision 233404) @@ -484,6 +484,9 @@ xdg_unichar_t *prefix, int depth) { + assert (*n >= 0); + assert (depth >= 0); + if (*n >= n_globs) return FALSE; @@ -495,7 +498,7 @@ { int i; - globs[*n] = malloc (depth * sizeof (char)); + globs[*n] = malloc ((depth + 1) * sizeof (char)); for (i = 0; i < depth; i++) globs[*n][depth - i - 1] = prefix[i]; globs[*n][depth] = '\0';