Solve buffer overflow on tab completion in ash

diff --git a/lib/libedit/complete.c b/lib/libedit/complete.c
index d454dc4d049d4a3fa14191c932b6fc1db50f6d58..cfdff493fad282d1c2b29d7bb428be82ca3e910d 100644 (file)
--- a/lib/libedit/complete.c
+++ b/lib/libedit/complete.c
@@ -188,7 +188,7 @@ rl_complete(pathname, unique)
     if (ac == 1) {
        /* Exactly one match -- finish it off. */
        *unique = 1;
-       j = strlen(av[0]) - len + 2;
+       j = strlen(av[0]) - len + 1;
        if ((p = NEW(char, j + 1)) != NULL) {
            COPYFROMTO(p, av[0] + len, j);
            if ((new = NEW(char, strlen(dir) + strlen(av[0]) + 2)) != NULL) {