diff options
| author | Denis Vlasenko <vda.linux@googlemail.com> | 2008-07-30 22:58:18 +0000 |
|---|---|---|
| committer | Denis Vlasenko <vda.linux@googlemail.com> | 2008-07-30 22:58:18 +0000 |
| commit | 20be63fe71466524c6110fcf02fb604a4010e1e0 (patch) | |
| tree | 34c5185efa22c3f8f2c7b9659dd28993b3b44275 /coreutils | |
| parent | b35714986721a6f36ecb87034e6024138f6c0b6e (diff) | |
| download | busybox-w32-20be63fe71466524c6110fcf02fb604a4010e1e0.tar.gz busybox-w32-20be63fe71466524c6110fcf02fb604a4010e1e0.tar.bz2 busybox-w32-20be63fe71466524c6110fcf02fb604a4010e1e0.zip | |
tr: fix yet another access past the end of a string (bug 4374)
Diffstat (limited to 'coreutils')
| -rw-r--r-- | coreutils/tr.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/coreutils/tr.c b/coreutils/tr.c index 860b8122b..c736c716b 100644 --- a/coreutils/tr.c +++ b/coreutils/tr.c | |||
| @@ -145,12 +145,14 @@ static unsigned int expand(const char *arg, char *buffer) | |||
| 145 | arg--; /* points to x */ | 145 | arg--; /* points to x */ |
| 146 | continue; /* copy all, including eventual ']' */ | 146 | continue; /* copy all, including eventual ']' */ |
| 147 | } | 147 | } |
| 148 | /* [x-y...] */ | 148 | /* [x-z] */ |
| 149 | arg++; | 149 | arg++; /* skip - */ |
| 150 | if (arg[0] == '\0' || arg[1] != ']') | ||
| 151 | bb_show_usage(); | ||
| 150 | ac = *arg++; | 152 | ac = *arg++; |
| 151 | while (i <= ac) | 153 | while (i <= ac) |
| 152 | *buffer++ = i++; | 154 | *buffer++ = i++; |
| 153 | arg++; /* skip the assumed ']' */ | 155 | arg++; /* skip ] */ |
| 154 | continue; | 156 | continue; |
| 155 | } | 157 | } |
| 156 | *buffer++ = *arg++; | 158 | *buffer++ = *arg++; |