From d581485d3244e15df5548573eef9d0e73af2eb53 Mon Sep 17 00:00:00 2001
From: Ron Koenderink <rkoenderink@yahoo.ca>
Date: Sun, 13 Nov 2005 23:18:37 +0000
Subject: [PATCH] (plurize): Fix the strncat() len parameter to prevent an
 overflow of buf.

(numstr, esplur, splur, iesplur, plurize): Move the prototype defintions from
misc.h to prototypes.h.  Remove unneccessary headers in plur.c.
---
 include/misc.h       |  5 -----
 include/prototypes.h |  6 ++++++
 src/lib/gen/plur.c   | 17 +++++++++--------
 3 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/include/misc.h b/include/misc.h
index 4a2ffb4d2..b0ccc0f27 100644
--- a/include/misc.h
+++ b/include/misc.h
@@ -135,11 +135,6 @@ extern int daemonize;
 double dmax(double n1, double n2);
 double dmin(double n1, double n2);
 
-extern s_char *numstr(s_char buf[], int n);
-extern s_char *esplur(int n);
-extern s_char *splur(int n);
-extern s_char *iesplur(int n);
-extern char *plurize(char *buf, int max_len, int n);
 extern char *getstarg(char *input, char *prompt, char buf[]);
 extern char *getstring(char *prompt, char buf[]);
 extern char *ugetstring(char *prompt, char buf[]);
diff --git a/include/prototypes.h b/include/prototypes.h
index 2f58ed01c..f2dba1e63 100644
--- a/include/prototypes.h
+++ b/include/prototypes.h
@@ -391,6 +391,12 @@ extern int parse(char *, char **, char **, char *, char **);
 extern int ldround(double, int);
 extern int roundintby(int, int);
 extern int scthash(register int, register int, int);
+/* plur.c */
+extern s_char *numstr(s_char buf[], int n);
+extern s_char *esplur(int n);
+extern s_char *splur(int n);
+extern s_char *iesplur(int n);
+extern char *plurize(char *buf, int max_len, int n);
 /* more in misc.h */
 
 /*
diff --git a/src/lib/gen/plur.c b/src/lib/gen/plur.c
index 76a6703d4..a681cb23b 100644
--- a/src/lib/gen/plur.c
+++ b/src/lib/gen/plur.c
@@ -31,8 +31,7 @@
  *     
  */
 
-#include "misc.h"
-#include "gen.h"
+#include "prototypes.h"
 
 s_char *
 splur(int n)
@@ -61,19 +60,21 @@ iesplur(int n)
 char *
 plurize(char *buf, int max_len, int n)
 {
-    if (!strlen(buf) || n <= 1)
+    size_t size = strlen(buf);
+
+    if (size || n <= 1)
 	return buf;
 
-    switch(buf[strlen(buf) - 1]) {
+    switch(buf[size - 1]) {
     case 'y':
-	buf[strlen(buf) -1] = '\0';
-	strncat(buf, "ies", max_len - 1);
+	buf[size - 1] = '\0';
+	strncat(buf, "ies", max_len - size - 1);
 	break;
     case 's':
-	strncat(buf, "es", max_len - 1);
+	strncat(buf, "es", max_len - size - 1);
 	break;
     default:
-	strncat(buf, "s", max_len - 1);
+	strncat(buf, "s", max_len - size - 1);
     }
     return buf;
 }
-- 
2.43.0