Fix out-of-bounds read in vfnameconcat.

* src/stringutils.c (_gpgrt_vfnameconcat): Use the correct value for
  the trailing slash check.
--

Reported-by: Dirk Mueller <[email protected]> (AI)

1 files changed, 4 insertions, 3 deletions

diff --git a/src/stringutils.c b/src/stringutils.c
index 1d3b920..539c116 100644
--- a/src/stringutils.c
+++ b/src/stringutils.c
@@ -67,7 +67,7 @@ _gpgrt_vfnameconcat (unsigned int flags,
 {
   const char *argv[32];
   int argc;
-  size_t n;
+  size_t n, n0;
   int skip = 1;  /* Characters to skip from FIRST_PART.  Only used if
                   * HOME is NULL */
   char *home_buffer = NULL;
@@ -101,8 +101,9 @@ _gpgrt_vfnameconcat (unsigned int flags,
       home = SYSCONFDIR;
 #endif
       skip = 0;
-      n += strlen (home);
-      if (n && home[n-1] != '/' && *first_part != '/')
+      n0 = strlen (home);
+      n += n0;
+      if (n0 && home[n0-1] != '/' && *first_part != '/')
         {
           extradelim = "/";
           n++;