dpkg: Fix off-by-one array allocation

We need two entries more than the current nfiles, one for the next one
and one for the final NULL.

debian/changelog

@@ -5,6 +5,8 @@ dpkg (1.18.6) UNRELEASED; urgency=medium
     files in the filesystem as «pathname».dpkg-new after configuration
     and without traces of the files in the dpkg database. Closes: #823288
   * Use m_strdup() instead of strdup() in dpkg recursive installation code.
+  * Fix off-by-one array allocation in dpkg recursive installation code that
+    can cause segfaults.
   * Packaging:
     - Bump Standards-Version to 3.9.8 (no changes needed).
 

src/archives.c

@@ -1482,7 +1482,7 @@ archivefiles(const char *const *argv)
         if (strcmp(nodename + strlen(nodename) - 4, ".deb") != 0)
           continue;
 
-        arglist = m_realloc(arglist, sizeof(char *) * (nfiles + 1));
+        arglist = m_realloc(arglist, sizeof(char *) * (nfiles + 2));
         arglist[nfiles++] = m_strdup(nodename);
       }