Fix buffer overrun in pg_upgrade.

Problem reported, and cause identified, by Hernan Gonzalez.

diff --git a/contrib/pg_upgrade/controldata.c b/contrib/pg_upgrade/controldata.c
index 009a1cc0985955e09727665ac86cf909b3d3e301..dd805a42acddb5d020f9450d28a1c30dcb89d9a0 100644 (file)
--- a/contrib/pg_upgrade/controldata.c
+++ b/contrib/pg_upgrade/controldata.c
@@ -545,7 +545,7 @@ putenv2(migratorContext *ctx, const char *var, const char *val)
        {
 #ifndef WIN32
                char       *envstr = (char *) pg_malloc(ctx, strlen(var) +
-                                                                                               strlen(val) + 1);
+                                                                                               strlen(val) + 2);
 
                sprintf(envstr, "%s=%s", var, val);
                putenv(envstr);