Argh!!! I guess nobody has ever looked at this code.

Author: rlerdorf

TODO_SEGFAULTS

@@ -7,13 +7,13 @@ Fixed:
     i18n_convert/mb_convert_encoding (Moriyoshi Koizumi)
     socket_iovec_alloc (Rasmus)
 	exif_imagetype,exif_thumbnail (Rasmus)
+    dbase_open (Rasmus)
 
 
 Open:
 
     array_pad
     bcsub (1)
-    dbase_open
     mb_ereg (2)
     mb_ereg_match (2)
     mb_eregi (2)

ext/dbase/dbf_head.c

@@ -247,9 +247,10 @@ dbhead_t *dbf_open(char *dp, int o_flags TSRMLS_DC)
 
 	cp = dp;
 	if ((fd = VCWD_OPEN(cp, o_flags|O_BINARY)) < 0) {
-		cp = (char *)malloc(256);
-		strcpy(cp, dp); strcat(cp, ".dbf");
+		cp = (char *)malloc(MAXPATHLEN);  /* So where does this get free()'d?  -RL */
+		strncpy(cp, dp, MAXPATHLEN-5); strcat(cp, ".dbf");
 		if ((fd = VCWD_OPEN(cp, o_flags)) < 0) {
+			free(cp);
 			perror("open");
 			return NULL;
 		}