tr: Fix '[=]=]' equivalence class.

A closing bracket immediately after '[=' should not be treated as special.

Different from the submitted patch, a string ending with '[=' does not cause
access beyond the terminating '\0'.

PR:		bin/150384
Submitted by:	Richard Lowe
MFC after:	2 weeks

4 files changed, 6 insertions, 2 deletions

diff --git a/tools/regression/usr.bin/tr/regress.0c.out b/tools/regression/usr.bin/tr/regress.0c.out
new file mode 100644
index 0000000..4e125ea
--- /dev/null
+++ b/tools/regression/usr.bin/tr/regress.0c.out
@@ -0,0 +1 @@
+[[[[
diff --git a/tools/regression/usr.bin/tr/regress.0d.out b/tools/regression/usr.bin/tr/regress.0d.out
new file mode 100644
index 0000000..8b13789
--- /dev/null
+++ b/tools/regression/usr.bin/tr/regress.0d.out
@@ -0,0 +1 @@
+
diff --git a/tools/regression/usr.bin/tr/regress.sh b/tools/regression/usr.bin/tr/regress.sh
index c448b6d..badef15 100644
--- a/tools/regression/usr.bin/tr/regress.sh
+++ b/tools/regression/usr.bin/tr/regress.sh
@@ -1,6 +1,6 @@
 # $FreeBSD$
 
-echo 1..12
+echo 1..14
 
 REGRESSION_START($1)
 
@@ -16,5 +16,7 @@ REGRESSION_TEST(`08', `tr "[[:upper:]]" "[[:lower:]]" < regress2.in | tr -d "[^[
 REGRESSION_TEST(`09', `printf "\\f\\r\\n" | tr "\\014\\r" "?#"')
 REGRESSION_TEST(`0a', `printf "0xdeadbeef\\n" | tr "x[[:xdigit:]]" "?\$"')
 REGRESSION_TEST(`0b', `(tr -cd "[[:xdigit:]]" < regress2.in ; echo)')
+REGRESSION_TEST(`0c', `echo "[[[[]]]]" | tr -d "[=]=]"')
+REGRESSION_TEST(`0d', `echo "]=[" | tr -d "[=]"')
 
 REGRESSION_END()
diff --git a/usr.bin/tr/str.c b/usr.bin/tr/str.c
index 86ae173..06a907b 100644
--- a/usr.bin/tr/str.c
+++ b/usr.bin/tr/str.c
@@ -156,7 +156,7 @@ bracket(s)
 		s->str = p + 1;
 		return (1);
 	case '=':				/* "[=equiv=]" */
-		if ((p = strchr(s->str + 2, ']')) == NULL)
+		if (s->str[2] == '\0' || (p = strchr(s->str + 3, ']')) == NULL)
 			return (0);
 		if (*(p - 1) != '=' || p - s->str < 4)
 			goto repeat;