From d94790d3acaa2b2fdd85f54c8c50299fde56e262 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Mon, 13 Jul 2026 21:03:46 +0800
Subject: [PATCH] fix: off-by-two in printinaddr remaining-length accounting

In printinaddr(), the remaining-length counter nl was decremented by
len - 1 instead of len + 1 after writing ":" + port string (len + 1
bytes). This inflated nl by 2 after each port field, allowing the final
snpf() to write 2 bytes past the end of the heap-allocated Namech buffer.

Reported-by: f9j2n6nd8k-eng
Fixes #365
---
 src/print.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/print.c b/src/print.c
index 15799794..0c82d9c9 100644
--- a/src/print.c
+++ b/src/print.c
@@ -1330,7 +1330,7 @@ static int printinaddr(struct lsof_context *ctx) {
                 goto addr_too_long;
             (void)snpf(np, nl, ":%s", port);
             np += len + 1;
-            nl -= len - 1;
+            nl -= len + 1;
         }
     }
     if (Namech[0]) {