BR 2048950: fix crash due to mmacro list overflow

When allocating the buffer for an mmacro list, we apparently failed to
guarantee space for the terminating NULL.  This almost certainly
caused the crash described in BR 2048950, and quite possibly BR
1284169.

1 files changed, 2 insertions, 1 deletions

diff --git a/preproc.c b/preproc.c
index e7a42528..99e89289 100644
--- a/preproc.c
+++ b/preproc.c
@@ -1434,7 +1434,8 @@ static void count_mmac_params(Token * t, int *nparam, Token *** params)
     *nparam = paramsize = 0;
     *params = NULL;
     while (t) {
-        if (*nparam >= paramsize) {
+	/* +1: we need space for the final NULL */
+        if (*nparam+1 >= paramsize) {
             paramsize += PARAM_DELTA;
             *params = nasm_realloc(*params, sizeof(**params) * paramsize);
         }