gftp-2.0.19的bug

在lib/charset-conv.c的_gftp_get_next_charset函数中有问题，原代码如下：
static /*@null@*/ char *
_gftp_get_next_charset (char **curpos)
{
  char *ret, *endpos;
  size_t len, retlen;

  if (**curpos == '\0')
    return (NULL);

  for (; **curpos == ' ' || **curpos == '\t'; (*curpos)++);

  if ((endpos = strchr (*curpos, ',')) == NULL)
    len = strlen (*curpos) - 1; /* the trailing ',' should be omitted */
  else
    len = endpos - *curpos;

  for (retlen = len - 1;
       (*curpos)[retlen - 1] == ' ' || (*curpos)[retlen - 1] == '\t';
       retlen--);

  retlen++; /* Needed due to the len - 1 above... */
  ret = g_malloc0 (retlen + 1);
  memcpy (ret, *curpos, retlen);

  for (*curpos += len; **curpos == ','; (*curpos)++);

  return (ret);
}

应修改为：
static /*@null@*/ char *
_gftp_get_next_charset (char **curpos)
{
  char *ret, *endpos;
  size_t len, retlen;

  if (**curpos == '\0')
    return (NULL);

  for (; **curpos == ' ' || **curpos == '\t'; (*curpos)++);

  if ((endpos = strchr (*curpos, ',')) == NULL)
    len = strlen (*curpos); /* the trailing ',' should be omitted */
  else
    len = endpos - *curpos;

  for (retlen = len;
       (*curpos)[retlen - 1] == ' ' || (*curpos)[retlen - 1] == '\t';
       retlen--);

  ret = g_malloc0 (retlen + 1);
  memcpy (ret, *curpos, retlen);

  for (*curpos += len; **curpos == ','; (*curpos)++);

  return (ret);
}