emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tr: fix yet another access past the end of a string (bug 4374)

Browse Source
This commit is contained in:
Denis Vlasenko 2008-07-30 22:58:18 +00:00
parent b357149867
commit 20be63fe71
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
coreutils/tr.c
View File

@ -145,12 +145,14 @@ static unsigned int expand(const char *arg, char *buffer)
arg--; /* points to x */ arg--; /* points to x */
continue; /* copy all, including eventual ']' */ continue; /* copy all, including eventual ']' */
} }
/* [x-y...] */ /* [x-z] */
arg++; arg++; /* skip - */
if (arg[0] == '\0' || arg[1] != ']')
bb_show_usage();
ac = *arg++; ac = *arg++;
while (i <= ac) while (i <= ac)
*buffer++ = i++; *buffer++ = i++;
arg++; /* skip the assumed ']' */ arg++; /* skip ] */
continue; continue;
} }
*buffer++ = *arg++; *buffer++ = *arg++;