20be63fe7
Denis Vlasenko
2008-07-30
Subject
tr: fix yet another access past the end of a string (bug 4374)
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
coreutils/tr.c+5 -3
| @@ -145,12 +145,14 @@ static unsigned int expand(const char *arg, char *buffer) | |
| arg--; /* points to x */ | |
| continue; /* copy all, including eventual ']' */ | |
| } | |
| - | /* [x-y...] */ |
| - | arg++; |
| + | /* [x-z] */ |
| + | arg++; /* skip - */ |
| + | if (arg[0] == '\0' || arg[1] != ']') |
| + | bb_show_usage(); |
| ac = *arg++; | |
| while (i <= ac) | |
| *buffer++ = i++; | |
| - | arg++; /* skip the assumed ']' */ |
| + | arg++; /* skip ] */ |
| continue; | |
| } | |
| *buffer++ = *arg++; | |