id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc
92	Unintended pointer incrementation in function outputResponse	Knut Landmark		"The following clause in function `outputResponse` (zoo-kernel/service_internal.c, rev. 459, line 1998 ) causes unexpected behavior:

{{{
    if(lenv!=NULL){
      tmp0=(char*)malloc((strlen(lenv->value)+strlen(_(""Unable to run the Service. The message returned back by the Service was the following: ""+1)))*sizeof(char));
      sprintf(tmp0,_(""Unable to run the Service. The message returned back by the Service was the following: %s""),lenv->value);
    }
}}}
The `const char*` argument to `strlen` is incremented by `+1`, whereas the intention is to allocate an additional byte. Line 1999 should presumably be written
{{{
     tmp0=(char*)malloc((strlen(lenv->value)+strlen(_(""Unable to run the Service. The message returned back by the Service was the following: ""))+1)*sizeof(char));
}}}

"	defect	closed	major		zoo-kernel		fixed