Alex Henrie (@alexhenrie) commented about server/fd.c:
- char *dir, *ret;
- /* remove trailing slashes if any */
- while (len > 0 && path[len - 1] == '/')
--len;
- while (len > 0 && path[len - 1] != '/')
--len;
- dir = malloc( len + 1 );
- memcpy( dir, path, len );
- dir[len] = 0;
- ret = realpath( dir, NULL );
- free( dir );
- ret = realloc( ret, strlen( ret ) + 1 + strlen( path + len ));
This allocation is missing the byte for the null terminator.