diff options
| author | jilles <jilles@FreeBSD.org> | 2010-09-29 22:24:18 +0000 |
|---|---|---|
| committer | jilles <jilles@FreeBSD.org> | 2010-09-29 22:24:18 +0000 |
| commit | 26abe50bf104fe7fd516f6a3d577d8d487da19ec (patch) | |
| tree | 1de27a5730d8afc2b3b9fe46d97090b19fd7c0e8 /usr.bin/tr | |
| parent | 15603271578efc774546f5e1ce9fda0f2b5e5898 (diff) | |
| download | FreeBSD-src-26abe50bf104fe7fd516f6a3d577d8d487da19ec.zip FreeBSD-src-26abe50bf104fe7fd516f6a3d577d8d487da19ec.tar.gz | |
tr: Fix '[=]=]' equivalence class.
A closing bracket immediately after '[=' should not be treated as special.
Different from the submitted patch, a string ending with '[=' does not cause
access beyond the terminating '\0'.
PR: bin/150384
Submitted by: Richard Lowe
MFC after: 2 weeks
Diffstat (limited to 'usr.bin/tr')
| -rw-r--r-- | usr.bin/tr/str.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/usr.bin/tr/str.c b/usr.bin/tr/str.c index 86ae173..06a907b 100644 --- a/usr.bin/tr/str.c +++ b/usr.bin/tr/str.c @@ -156,7 +156,7 @@ bracket(s) s->str = p + 1; return (1); case '=': /* "[=equiv=]" */ - if ((p = strchr(s->str + 2, ']')) == NULL) + if (s->str[2] == '\0' || (p = strchr(s->str + 3, ']')) == NULL) return (0); if (*(p - 1) != '=' || p - s->str < 4) goto repeat; |
