fix buffer overrun (LP#1533394)

This commit is contained in:
tg 2016-01-14 21:17:50 +00:00
parent 5be0ec410e
commit 000580ca8f
1 changed files with 4 additions and 3 deletions

7
expr.c
View File

@ -2,7 +2,7 @@
/*-
* Copyright (c) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
* 2011, 2012, 2013, 2014
* 2011, 2012, 2013, 2014, 2016
* mirabilos <m@mirbsd.org>
*
* Provided that these terms and disclaimer and all copyright notices
@ -23,7 +23,7 @@
#include "sh.h"
__RCSID("$MirOS: src/bin/mksh/expr.c,v 1.80 2015/11/29 17:05:00 tg Exp $");
__RCSID("$MirOS: src/bin/mksh/expr.c,v 1.81 2016/01/14 21:17:50 tg Exp $");
/* the order of these enums is constrained by the order of opinfo[] */
enum token {
@ -659,7 +659,8 @@ exprtoken(Expr_state *es)
es->tok = VAR;
} else if (c == '1' && cp[1] == '#') {
cp += 2;
cp += utf_ptradj(cp);
if (*cp)
cp += utf_ptradj(cp);
strndupx(tvar, es->tokp, cp - es->tokp, ATEMP);
goto process_tvar;
#ifndef MKSH_SMALL