Fix buffer overflow in gie.c:append_args() (#1023)

Observed a buffer overflow in append_args with autofuzz with the strcpy in append_args.
I think the +2 is required to account for both a nul char and the space.

1 files changed, 2 insertions, 1 deletions

diff --git a/src/gie.c b/src/gie.c
index 1e362181..ab09dc14 100644
--- a/src/gie.c
+++ b/src/gie.c
@@ -1422,7 +1422,8 @@ static int append_args (ffio *G) {
     if (tag)
         skip_chars = strlen (tag);
 
-    if (G->args_size < args_len + next_len - skip_chars + 1) {
+    /* +2: 1 for the space separator and 1 for the NUL termination. */
+    if (G->args_size < args_len + next_len - skip_chars + 2) {
         void *p = realloc (G->args, 2 * G->args_size);
         if (0==p)
             return 0;