runrev/livecode — pull request #1433 by peter-b (2014-11-03 14:10:09+00:00)
Title: libfoundation: MCStringCreateMutable(): Set length of string to zero.

When `MCStringCreateMutable()` is called with a non-zero
`p_initial_capacity`, `__MCStringExpandAt()` provides a buffer of the
requested length for the `__MCString`. However, it also sets the
char_count of the `__MCString` to the same length. This can cause the
resulting `__MCString` to contain arbitrary data.