Fixed memory access bug in gui.dialog(); src/textadept.c

1 files changed, 2 insertions, 1 deletions

diff --git a/src/textadept.c b/src/textadept.c
index a9e7bda4..f590bc90 100644
--- a/src/textadept.c
+++ b/src/textadept.c
@@ -2008,7 +2008,7 @@ static int l_cf_gui_dialog(lua_State *lua) {
   int i, j, k, n = lua_gettop(lua) - 1, argc = n;
   for (i = 2; i < n + 2; i++)
     if (lua_type(lua, i) == LUA_TTABLE) argc += lua_objlen(lua, i) - 1;
-  const char **argv = malloc(argc * sizeof(const char *));
+  const char **argv = malloc((argc + 1) * sizeof(const char *));
   for (i = 0, j = 2; j < n + 2; j++)
     if (lua_type(lua, j) == LUA_TTABLE) {
       int len = lua_objlen(lua, j);
@@ -2018,6 +2018,7 @@ static int l_cf_gui_dialog(lua_State *lua) {
         lua_pop(lua, 1);
       }
     } else argv[i++] = luaL_checkstring(lua, j);
+  argv[argc] = 0;
   char *out = gcocoadialog(type, argc, argv);
   lua_pushstring(lua, out);
   free(out);