From 26abe50bf104fe7fd516f6a3d577d8d487da19ec Mon Sep 17 00:00:00 2001 From: jilles Date: Wed, 29 Sep 2010 22:24:18 +0000 Subject: tr: Fix '[=]=]' equivalence class. A closing bracket immediately after '[=' should not be treated as special. Different from the submitted patch, a string ending with '[=' does not cause access beyond the terminating '\0'. PR: bin/150384 Submitted by: Richard Lowe MFC after: 2 weeks --- usr.bin/tr/str.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'usr.bin') diff --git a/usr.bin/tr/str.c b/usr.bin/tr/str.c index 86ae173..06a907b 100644 --- a/usr.bin/tr/str.c +++ b/usr.bin/tr/str.c @@ -156,7 +156,7 @@ bracket(s) s->str = p + 1; return (1); case '=': /* "[=equiv=]" */ - if ((p = strchr(s->str + 2, ']')) == NULL) + if (s->str[2] == '\0' || (p = strchr(s->str + 3, ']')) == NULL) return (0); if (*(p - 1) != '=' || p - s->str < 4) goto repeat; -- cgit v1.1