Critical bug: realloc size uncorrect

README.md

@@ -14,4 +14,4 @@ Supports **SSDP** (*UPnP* network detection part) only over **IPv4**.
 Programmed mainly in **C** for *SSDP* part, with some piece in **PHP** for *UPnP* service description.
 
 ## Releases
-* Version 0.23: https://github.com/julienblitte/tiny-ssdp/releases/tag/0.23
+* Version 0.231: https://github.com/julienblitte/tiny-ssdp/releases/tag/0.231

arch-armhf/DEBIAN/control

@@ -1,5 +1,5 @@
 Package: tiny-ssdp
-Version: 0.23
+Version: 0.231
 Architecture: armhf
 Maintainer: Julien Blitte <julien.blitte@gmail.com>
 Installed-Size: 1024

src/http.c

@@ -29,13 +29,19 @@ const char *http_search_variable(text t, const char *variable)
 	char *pattern;
 	size_t len;
 
+	fprintf(stderr, "<debug> http_search_variable(\"%p\",\"%s\")\n", t, variable);
+
 	len = strlen(variable)+1;
 	pattern = (char *)malloc(len+1); // pattern must be freed (1)
 
 	snprintf(pattern, len+1, "%s:", variable);
+	fprintf(stderr, "<debug> pattern: \"%s\"\n", pattern);
 
 	for(l=0; t[l]; l++)
 	{
+		fprintf(stderr, "<debug> l=%d\n", l);
+		fprintf(stderr, "<debug> t[l]=%p\n", t[l]);
+		fprintf(stderr, "<debug> strncasecmp(\"%s\",\"%s\")\n", t[l], pattern);
 		if (!strncasecmp(t[l], pattern, len))
 		{
 			free(pattern); // pattern freed here (1) 1/2

src/textutil.c

@@ -64,7 +64,7 @@ text data2text(char *data)
 
 	if (i < MAX_LINES-1)
 	{
-		result = realloc(result, i+1);
+		result = realloc(result, sizeof(char*)*(i+1));
 	}
 
 	return result;