From 57e5338ebd052a33fc16fe38dd8d42fccacb0823 Mon Sep 17 00:00:00 2001
From: Renaud Fivet <renaud.fivet@gmail.com>
Date: Fri, 9 Jan 2015 09:46:03 +0800
Subject: [PATCH] Insure &low and &upp don't point to the stack.

---
 eval.c | 25 +++++++++++++++++++++----
 eval.h |  1 -
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/eval.c b/eval.c
index d81150f..ee93dfd 100644
--- a/eval.c
+++ b/eval.c
@@ -66,6 +66,7 @@ static char errorm[] = "ERROR" ;	/* error literal                */
 static int seed = 0 ;			/* random number seed           */
 
 static char *ltos( int val) ;
+static char *mkupper( char *str) ;
 
 /* List of recognized environment variables. */
 
@@ -396,7 +397,7 @@ char *gtfun(char *fname)
 		}
 
 		strcpy( result, arg1) ;
-		strcat( &result[ sz1], argx) ;
+		strcpy( &result[ sz1], argx) ;
 		retstr = result ;
 	}
 		break ;
@@ -468,10 +469,26 @@ char *gtfun(char *fname)
 		retstr = i_to_a( strlen( argx)) ;
 		break ;
 	case UFUPPER:
-		retstr = mkupper( argx) ;
+		sz = strlen( argx) ;
+		if( sz >= ressize) {
+			free( result) ;
+			result = malloc( sz + 1) ;
+			ressize = sz + 1 ;
+		}
+
+		strcpy( result, argx) ;	/* result is at least as long as argx */
+		retstr = mkupper( result) ;
 		break ;
 	case UFLOWER:
-		retstr = mklower( argx) ;
+		sz = strlen( argx) ;
+		if( sz >= ressize) {
+			free( result) ;
+			result = malloc( sz + 1) ;
+			ressize = sz + 1 ;
+		}
+
+		strcpy( result, argx) ;	/* result is at least as long as argx */
+		retstr = mklower( result) ;
 		break ;
 	case UFTRUTH:
 		retstr = ltos( atoi( argx) == 42) ;
@@ -1240,7 +1257,7 @@ static char *ltos( int val)
  *
  * char *str;		string to upper case
  */
-char *mkupper(char *str)
+static char *mkupper( char *str)
 {
 	char *sp;
 
diff --git a/eval.h b/eval.h
index 84a5b58..124ba20 100644
--- a/eval.h
+++ b/eval.h
@@ -46,7 +46,6 @@ int setvar( int f, int n) ;
 char *i_to_a( int i) ;
 char *getval( char *token) ;
 int stol( char *val) ;
-char *mkupper( char *str) ;
 char *mklower( char *str) ;
 int abs( int x) ;
 int ernd( void) ;