Index: lib/url.c =================================================================== RCS file: /cvsroot/curl/curl/lib/url.c,v retrieving revision 1.483 diff -u -r1.483 url.c --- lib/url.c 30 Nov 2005 13:09:48 -0000 1.483 +++ lib/url.c 30 Nov 2005 23:25:49 -0000 @@ -2378,12 +2378,18 @@ if(urllen < LEAST_PATH_ALLOC) urllen=LEAST_PATH_ALLOC; - conn->pathbuffer=(char *)malloc(urllen); + /* + * We malloc() the buffers below urllen+2 to make room for to possibilities: + * 1 - an extra terminating zero + * 2 - an extra slash (in case a syntax like "www.host.com?moo" is used) + */ + + conn->pathbuffer=(char *)malloc(urllen+2); if(NULL == conn->pathbuffer) return CURLE_OUT_OF_MEMORY; /* really bad error */ conn->path = conn->pathbuffer; - conn->host.rawalloc=(char *)malloc(urllen); + conn->host.rawalloc=(char *)malloc(urllen+2); if(NULL == conn->host.rawalloc) return CURLE_OUT_OF_MEMORY; conn->host.name = conn->host.rawalloc;