Fix memory corruption problem in bit string formatting logic.

NEWS

@@ -9,6 +9,7 @@ documents those changes that are of interest to users and admins.
     rather than just using a cyclic counter and hoping to avoid collisions. 
  -- Plug memory leak in freeing job info retrieved using API.
  -- Bluegene Plugin handles long deallocating states from driver 202.
+ -- Fix bug in bitfmt2int() which can go off allocated memory.
 
 * Changes in SLURM 0.5.0-pre8
 =============================

src/common/bitstring.c

@@ -749,7 +749,8 @@ bitfmt2int (char *bit_str_ptr)
 	if (bit_str_ptr == NULL) 
 		return NULL;
 	size = strlen (bit_str_ptr) + 1;
-	bit_int_ptr = xmalloc ( sizeof (int *) * size);
+	bit_int_ptr = xmalloc ( sizeof (int *) * 
+			(size * 2 + 1));	/* more than enough space */
 	if (bit_int_ptr == NULL)
 		return NULL;
 
@@ -778,6 +779,7 @@ bitfmt2int (char *bit_str_ptr)
 			sum = 0;
 		}
 	}
+	assert(bit_inx < (size*2+1));
 	bit_int_ptr[bit_inx] = -1;
 	return bit_int_ptr;
 }