fix buffer overrun (LP#1533394)

This commit is contained in:
tg 2016-01-14 21:17:50 +00:00
parent 5be0ec410e
commit 000580ca8f
1 changed files with 4 additions and 3 deletions

5
expr.c
View File

@ -2,7 +2,7 @@
/*- /*-
* Copyright (c) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, * Copyright (c) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010,
* 2011, 2012, 2013, 2014 * 2011, 2012, 2013, 2014, 2016
* mirabilos <m@mirbsd.org> * mirabilos <m@mirbsd.org>
* *
* Provided that these terms and disclaimer and all copyright notices * Provided that these terms and disclaimer and all copyright notices
@ -23,7 +23,7 @@
#include "sh.h" #include "sh.h"
__RCSID("$MirOS: src/bin/mksh/expr.c,v 1.80 2015/11/29 17:05:00 tg Exp $"); __RCSID("$MirOS: src/bin/mksh/expr.c,v 1.81 2016/01/14 21:17:50 tg Exp $");
/* the order of these enums is constrained by the order of opinfo[] */ /* the order of these enums is constrained by the order of opinfo[] */
enum token { enum token {
@ -659,6 +659,7 @@ exprtoken(Expr_state *es)
es->tok = VAR; es->tok = VAR;
} else if (c == '1' && cp[1] == '#') { } else if (c == '1' && cp[1] == '#') {
cp += 2; cp += 2;
if (*cp)
cp += utf_ptradj(cp); cp += utf_ptradj(cp);
strndupx(tvar, es->tokp, cp - es->tokp, ATEMP); strndupx(tvar, es->tokp, cp - es->tokp, ATEMP);
goto process_tvar; goto process_tvar;