From f6cbaea604ab0b64c46a3febbf725b35f6bbae7a Mon Sep 17 00:00:00 2001
From: Holger Vogt <holger.vogt@uni-due.de>
Date: Tue, 28 Aug 2018 18:45:19 +0200
Subject: [PATCH] data[i] is no longer written beyond its allocated length

---
 src/frontend/com_compose.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/frontend/com_compose.c b/src/frontend/com_compose.c
index e3f2211c7..bf0464a36 100644
--- a/src/frontend/com_compose.c
+++ b/src/frontend/com_compose.c
@@ -403,7 +403,8 @@ com_compose(wordlist *wl)
 
         if (lingiven) {
             /* Create a linear sweep... */
-            data = TMALLOC(double, (int) lin);
+            length = (int)lin;
+            data = TMALLOC(double, length);
             if (stepgiven && startgiven && stopgiven) {
                 if (step != (stop - start) / lin * (reverse ? -1 : 1)) {
                     fprintf(cp_err,
@@ -431,13 +432,14 @@ com_compose(wordlist *wl)
             if (!stepgiven) {
                 step = (stop - start) / lin;
             }
+
             if (reverse)
-                for (i = 0, tt = stop; i < lin; i++, tt -= step)
+                for (i = 0, tt = stop; i < length; i++, tt -= step)
                     data[i] = tt;
             else
-                for (i = 0, tt = start; i < lin; i++, tt += step)
+                for (i = 0, tt = start; i < length; i++, tt += step)
                     data[i] = tt;
-            length = (int)lin;
+
         } else if (loggiven || decgiven) {
             /* Create a log sweep... */
         } else if (randmgiven) {