Fix link grafting bug.

Reported by Travis Ormandy in comp.unix.programmer.

* safepath.c (safepath_check): In the case when
we are combining a relative symlink target with
remaining material from the path, there is a forgotten
1 offset which causes the slash between them to
be deleted.

1 files changed, 1 insertions, 1 deletions

diff --git a/safepath.c b/safepath.c
index 06b835a..f91ff58 100644
--- a/safepath.c
+++ b/safepath.c
@@ -470,7 +470,7 @@ int safepath_check(const char *name)
           memcpy(resolved, copy, pos);
           strcpy(resolved + pos, link);
           resolved[pos + len] = '/';
-          strcpy(resolved + pos + len, copy + nxslash + 1);
+          strcpy(resolved + pos + len + 1, copy + nxslash + 1);
           free(copy);
           copy = resolved;
           continue;