dmi: fix more pointer subtraction bugs

Two more places with bogus pointer subtraction...

Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>

1 files changed, 2 insertions, 2 deletions

diff --git a/core/dmi.c b/core/dmi.c
index 988a4e8e..e4deb15b 100644
--- a/core/dmi.c
+++ b/core/dmi.c
@@ -283,13 +283,13 @@ static const char *dmi_install_string(const char *pfx, const char *str)
     }
 
     pfxlen = strlen(pfx);
-    q = nstr = malloc(pfxlen + (ep-p) + 1);
+    q = nstr = malloc(pfxlen + (ep-str) + 1);
     if (!nstr)
 	return NULL;
     memcpy(q, pfx, pfxlen);
     q += pfxlen;
     memcpy(q, str, ep-str);
-    q += (ep-p);
+    q += (ep-str);
     *q = '\0';
 
     return nstr;